Commit Graph

37226 Commits

Author SHA1 Message Date
Kyle M Hall bf793c3fe0 Bug 24106: In returns.pl, don't search for item if no barcode is provided
When loading returns.pl, code to check rotating collections fires off an search for items by barcode, but doesn't check for a barcode first. This means the code will search for items where barcode is NULL, which is definitely not the intended function.

Test Plan:
1) Apply this patch
2) Set up a rotating collection with items
3) Transfer the collection
4) Check in a rotating collection item
5) Note no change in functionality

Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
2019-12-19 22:06:59 +00:00
Owen Leonard 6f102abcb1 Bug 24124: Fix authorities selection in batch deletion tool in Chrome
This patch adds some inline CSS to force clearing on some elements in
the forms for batch record modification and deletion. The problem with
selecting the "Authorities" radio button stemmed from the fact that
non-clearing floats caused elements to invisibly overlap in the form.

To test, apply the patch and test both batch record modification and
batch record deletion. Upon selecting the "Authorities" radio button in
each case the "Select a list of records" tab should disappear. Selecting
the "Biblios" option should re-display the tab.

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
2019-12-19 22:02:34 +00:00
Nick Clemens cb1db1ddb1 Bug 24164: Unit test
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
2019-12-19 22:00:34 +00:00
Nick Clemens bb110db48d Bug 24164: Copy the letter for each email
To test:
1 - Set or have two patrons with emails - note thier borrowernumber for the report
2 - Create a report - note the report id ($REPORT_ID)
SELECT borrowernumber, surname, firstname, email FROM borrowers WHERE borrowernumber IN (##,##);
3 - Create a notice in circulation with code TESTEMAIL
4 - The content should be "[% surname %]"
5 - perl misc/cronjobs/patron_emailer.pl --report $REPORT_ID --notice TESTEMAIL --module circulation --from anyone@anywhere.com --verbose
6 - Note that the emails both have the same surname
7 - Apply patch
8 - Repeat 5
9 - Emails now have correct content

Signed-off-by: Kelly McElligott <kelly@bywatersolutions.com>
Signed-off-by: Jessica Zairo <jzairo@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
2019-12-19 22:00:24 +00:00
Jonathan Druart 17eabbf4bf Bug 24138: Fix calculation of suspension days when a limit is set
If there is a limit for the number of suspension days
(maxsuspensiondays), the calculation is wrong. We are reducing the
number of days before taking into account the suspension charging
interval.

For instance, a checkin is 1 year late and the circ rules are defined to
charge 7 days every 15 days.
It results in 365 * 7 / 15 days of suspension => 170 days

Before this patch the calculation was:
365 * 7 limited to 333, 333 / 15 => 22 days

Test plan:
Given the examples in the commit messages and the description of the bug
report, setup complex circulation rules and confirm that the debarment
dates are calculated correctly

Signed-off-by: Hugo Agud <hagud@orex.es>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
2019-12-19 21:51:17 +00:00
Jonathan Druart 1bf0904d28 Bug 24138: Move the calculation out of the sub
No changes expected here. For the next patch we are going to need to add
test and calculate the new debarment date. To ease the writing of these
tests the calculation is moved out of the existing subroutine.

Signed-off-by: Hugo Agud <hagud@orex.es>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
2019-12-19 21:51:03 +00:00
Jonathan Druart c589da3c29 Bug 23970: Make search with "Publication date" field work at any position
The changes made in the following commit:
  commit 0d2e83bca5
  Bug 14636: Item search - fix search and sort by publication date for MARC21
was put at the wrong place. It was inside a "if $i == 1" test that
impacts the first field only.

Test plan:
0/ Use a MARC21 installation
1/ Search items by publication date, use twice the field using different
values.
For instance:
  publication date: 2005 OR
  publication date: 2006
=> Without this patch you only get results for 2005
=> With this patch applied you get results for both years.

Signed-off-by: Joonas Kylmälä <joonas.kylmala@helsinki.fi>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
2019-12-19 21:45:19 +00:00
Tomas Cohen Arazi 5a3056e2a6 Bug 24177: (QA follow-up) Fix warning
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
2019-12-19 21:39:58 +00:00
Josef Moravec 81403f4612 Bug 24177: Import Koha::Account::CreditTypes to cash_register_stats.pl
Test plan:
0) Do not apply the patch
1) Confirm the bug - go to Reports -> Cash register
--> You will see ISE
2) Apply the patch, and restart_all
3) Confirm the ISE is gone and you see the form for Cash register report

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
2019-12-19 21:39:12 +00:00
Nick Clemens 588f67a26d Bug 24128: Add alias for biblionumber search
To test:
1 - In staff or OPAC using ES, search for "biblionumber:3" or any existing biblionumber
2 - No results
3 - Apply patch, restart all the things
4 - Search again
5 - You go to the biblionumber

Signed-off-by:  Bob Bennhoff <bbennhoff@clicweb.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
2019-12-19 17:12:44 +00:00
Jonathan Druart 569a098f7d Bug 24199: (bug 23042 follow-up) Prevent t/Auth_with_shibboleth.t to fail randomly
CGI->url_param does not always return the parameters in the same order.

Test plan:
0/ Recreate the random failure, does not apply the patch and run
t/Auth_with_shibboleth.t several times.
You will notice that it fails inconsistenly
1/ Apply the patch and confirm that it now passes 100% of the time

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
2019-12-16 21:38:45 +00:00
Tomas Cohen Arazi 0e21de15d6 Bug 23246: (follow-up) Hardcoding tab position is not enough
There are many conditions that determine the tab number for 'media'.
Translated into variables that hold the tabs count on each condition, it
is clear that '3' was not good enough:
            [%- holdings      = (SeparateHoldings)   ? 2 : 1
                notes         = (MARCNOTES || notes) ? 1 : 0
                acq           = (Koha.Preference('AcquisitionDetails')) ? 1 : 0
                frbr          = (FRBRizeEditions  && XISBNS) ? 1 : 0
                local_covers  = (LocalCoverImages && (localimages || CAN_user_tools_upload_local_cover_images)) ? 1 : 0
                media_tab     = holdings + notes + acq + frbr + local_covers
            -%]

This patch gets rid of the hardcoded value, adds an id to the 'media'
tab (i.e. 'media_tab') and uses JS to get the right index.

To test:
- Play with the different options governing those variables
=> FAIL: 3 is not always the 'media' tab
- Apply this patch
- Repeat your tests
=> SUCCESS: It always picks the 'media' tab
- Sign off :-D

Sponsored-by: American Numismatics Society
Signed-off-by: Maryse Simard <maryse.simard@inlibro.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
2019-12-16 17:54:55 +00:00
Tomas Cohen Arazi 7a9d8937f7 Bug 23246: Only jump into the 'images' tab HTML5MediaEnabled is set
This patch makes jumping into the third tab happen only if
HTML5MediaEnabled is set to 'both' or 'staff'.

To test:
- Have HTML5MediaEnabled set to 'opac' or 'not at all'
- Open the detail page of a record with no holdings
=> FAIL: The 'images' tab is selected
- Apply this patch
- Reload
=> SUCCESS: The 'holdings' tab is selected as it should be.
- Sign off :-D

Sponsored-by: America Numismatic Society
Signed-off-by: Maryse Simard <maryse.simard@inlibro.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
2019-12-16 17:54:39 +00:00
Owen Leonard 98a2090a0e Bug 24126: Article requests tab appears twice on patron's checkout screen
This patch removes duplicated markup on the checkout page which results
in the "Article requests" tab appearing twice.

To test, apply the patch and enable ArticleRequests.

Check out to a patron. In the set of tabs that includes checkouts,
holds, restrictions, etc., the "Article requests" tab should appear only
once.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
2019-12-16 17:40:57 +00:00
Jonathan Druart 7c5a0759ac Bug 23987: "return to cataloguing" if the record is deleted from bachMod-del
If a bibliographic record is deleted after having deleted all their items in a batch,
we should not display a "return to the record" button but "return to cataloguing" instead

Test plan:
1 - Have/make a bib with items
2 - On details page select Edit->Delete items in a batch
3 - Select all items and check "Delete record if no items remain"
4 - Delete the things
5 - On confirmation screen you have a count of items/bibs deleted
=> Without the patch there is a 'Return to record' button that leads to nowhere
=> With this patch there is a "Return to cataloging module" button
6 - Repeat using the "Delete selected items" link on top of the items table
=> Without the patch there is a 'Return to where you were' button that leads to nowhere
=> With this patch there is a "Return to cataloging module" button

Note that there is a link AND a button, coming from
  commit 928c0af2b6
  Bug 15824 - 'Done' button is unclear on batch item modification and deletion
I do not think it makes sense to have both.

Signed-off-by: George Williams <george@nekls.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
2019-12-16 17:33:29 +00:00
Jonathan Druart 54e1148332 Bug 23987: Use src=CATALOGUING for edition/deletion in batch from items table
There are 2 ways to land in batchMod from the detail page of a bib
record: from the Edit menu, and the action buttons on top of the items
table.

We want the same behavior for both and so use src=CATALOGUING
It will make batchMod to behave identically for the "return" button

Signed-off-by: George Williams <george@nekls.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
2019-12-16 17:33:14 +00:00
Lisette Scheer 529cd43b68 Bug 24033: Fix column labelling on basket summary page (ecost)
When viewing a basket, some of the column names are unclear
and are different than the terms used for the same field
on the order form. This patch edits the column titles to
match the order form.

To test:
1) In acquisitions, create a budget.
2) In acquisitions, create a fund.
3) In acquisitions, create a vendor.
4) In acquisitions, create a basket and add a test item to the basket.
5) Observe the column titles ecost tax inc. and ecost tax exc.
   Check the column visibility settings if you don't see
   the columns.
6) Apply the patch.
7) Observe the column titles have been updated.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
2019-12-11 20:27:37 +00:00
Lisette Scheer 3f80f32ccf Bug 24056: Capitalization: Cash Register ID on cash register management page
When editing a cash register, Cash register ID doesn't follow
our capitalization guidelines. This patch fixes that.

To Test:
1) Turn on cash register usage in the system preferences.
2) Add a cash register.
3) Edit the cash register.
4) Note the incorrect capitalization.
5) Apply the patch.
6) Edit the cash register.
7) Note the correct capitalization.

Signed-off-by: George Williams <george@nekls.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
2019-12-11 20:16:48 +00:00
Owen Leonard ae95c1ea16 Bug 24057: Hea is not an acronym
This patch changes "HEA" (incorrectly capitalized) to "Hea" on the
staff client administration home page.

To test, apply the patch and set the "UsageStats" system preference to
"No, let me think about it."

 - Go to Administration in the staff client.
 - There should be a message at the top asking if you want to share
   anonymous usage statisitcs with the community. The word "Hea" in this
   message should be capitalized correctly.

Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
2019-12-11 16:39:42 +00:00
Jonathan Druart c5336e24eb Bug 24168: (bug 23116 follow-up) AllowHoldPolicyOverride allows a librarian to almost place a hold on an item already on hold
This patch actually fixes the issue described on bug 23116.

Test plan:
See bug 23116 and comment 5. Important to note that the later comparison with
itemAlreadyOnHold assumes that the variable is a string.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
2019-12-10 19:52:20 +00:00
Martin Renvoize 98b3ae9f41 Bug 24136: Update sponsors for 19.11 cycle
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
2019-12-10 19:49:39 +00:00
Lisette Scheer 9b0ad66e02 Bug 24053: Typo in FinePaymentAutoPopup description
There is a typo in the FinePaymentAutoPopup system preference description.
This patch fixes that.

To test:
1) Go to the systems preferences in administration.
2) Search for FinePaymentAutoPopup
3) Observe .. at the end of the preference description.
4) Apply the patch
5) Repeat steaps 1-2
6) Ovserve correct punctuation at the end of the preference description.

Signed-off-by: Séverine QUEUNE <severine.queune@bulac.fr>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
2019-12-10 19:48:11 +00:00
Jonathan Druart 678b4bf464 Bug 24145: (bug 22543 follow-up) Fix Auth.t
Auth.t is failing because of: 1. recent changes from bug 22543 and 2. wrong mocked CGI->param in tests
Without this patch we hit the exit statement that breaks the tests with the following error:

t/db_dependent/Auth.t .. 1/22 Un-mocked method 'url()' called at /kohadevbox/koha/C4/Auth.pm line 1223.
Un-mocked method 'redirect()' called at /kohadevbox/koha/C4/Auth.pm line 1227.
A context appears to have been destroyed without first calling release().
Based on $@ it does not look like an exception was thrown (this is not always
a reliable test)

This is a problem because the global error variables ($!, $@, and $?) will
not be restored. In addition some release callbacks will not work properly from
inside a DESTROY method.

Here are the context creation details, just in case a tool forgot to call
release():
  File: t/db_dependent/Auth.t
  Line: 74
  Tool: Test::More::subtest

Cleaning up the CONTEXT stack...
    # Looks like you planned 22 tests but ran 1.
t/db_dependent/Auth.t .. Dubious, test returned 255 (wstat 65280, 0xff00)
Failed 21/22 subtests

Test Summary Report
-------------------
t/db_dependent/Auth.t (Wstat: 65280 Tests: 1 Failed: 0)
  Non-zero exit status: 255
  Parse errors: Bad plan.  You planned 22 tests but ran 1.
Files=1, Tests=1,  2 wallclock secs ( 0.02 usr  0.00 sys +  1.54 cusr  0.24 csys =  1.80 CPU)
Result: FAIL

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
2019-12-10 19:37:06 +00:00
Jonathan Druart 9cade9186d Bug 24144: (bug 23836 follow-up) Fix regressions.t tests
Bug 23836 changes the behavior for tracklinks.pl but did not adjust the
tests.

We must then expect 404 if the pref is turned off.
Also mock_preference cannot work (we are hitting the web server and so
need to set the value in DB and flush the L1 caches)

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
2019-12-09 23:53:05 +00:00
Martin Renvoize d81421a129
Corrections to teams for 20.05 cycle 2019-11-29 12:10:34 +00:00
Martin Renvoize 0553463d04
Update release notes for 19.11.00 release
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-28 18:25:06 +00:00
Martin Renvoize 019eff289b
Maintanence team template corrections
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-28 18:25:01 +00:00
Martin Renvoize bdf9e11abb
Add release team for 20.05 cycle
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-28 17:00:31 +00:00
Martin Renvoize 24504b320e
Increment version for 19.11.00 release
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 16:34:49 +00:00
Martin Renvoize 5a2ef6fe57
Align DB updates
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 16:34:49 +00:00
Martin Renvoize 2135352417
Translation Fixes
Correct some fatal errors in the translation files

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 15:54:31 +00:00
Koha translators d5a386db8e
Translation updates for Koha 19.11.00
(cherry picked from commit bc938166712f17d731a1f190628c27593a082419)
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 15:54:31 +00:00
Martin Renvoize e493cca4a0
Bug 24130: (RM follow-up) Fix old invalid data
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 15:54:23 +00:00
Martin Renvoize 92d3e72da0
Update contributors statistics for release
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:33:56 +00:00
Jonathan Druart 8a766c2208
Bug 23042: Correct shib param escaping
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:20 +00:00
Martin Renvoize 4e02adb5df
Bug 23042: Only include GET params in return URL for Shibboleth
The shibboleth return target included POST parameters in the URL string,
this meant that a failed local login POST would include the username and
password used in the attemtped login in plaintext in the redirect URL
that is appended to the shibboleth login URL.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:20 +00:00
Martin Renvoize d93f17bfaa
Bug 23042: Add tests to catch POST params in return URL
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:20 +00:00
Jonathan Druart 3493cffd54
Bug 23836: exit after output_error
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:19 +00:00
Nick 863a961dcb
Bug 23836: Don't forward form tracklinks if not tracking
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:19 +00:00
Martin Renvoize bbf7fad55f
Bug 23329: (RM follow-up) Restore DB after test
Test plan:
1) Dump your DB before the tests is run
2) Run the test
3) Dumper your DB again and compare to the first dump
Success if there are no differences (other than the timestamp of the
dump)

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:19 +00:00
Jonathan Druart 20854939b4
Bug 23329: Fix tests
- www.google.com vs https://www.google.com
- Remove transaction otherwise data are not available from webserver
- Use new C4::Output::output_error to avoid 302 (redirect)

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:19 +00:00
Jonathan Druart 7fa1cde78e
Bug 23329: Move error page to its own subroutine
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:19 +00:00
Martin Renvoize fde00fefec
Bug 23329: (RM follow-up) Add regression tests
Test plan:

Run the new tests and they should all pass once we've caught all cases

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:19 +00:00
Marcel de Rooy eb89795328
Bug 23329: (QA follow-up) Resolve warning on wrong biblionumber
Passing a wrong biblionumber generates a warning:
    GetMarcUrls called on undefined record at opac/tracklinks.pl line 58.

Test plan:
[1] Try it again with a wrong biblionumber and check the logs.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:19 +00:00
Marcel de Rooy b2ec43cd8c
Bug 23329: (follow-up) Allow item URI with a biblionumber parameter
If you pass a URI with a biblionumber without specifying the itemnumber,
tracklinks did not redirect an item URI.

Test plan:
[1] Add URI in an item.
[2] Pass this URI with the itemnumber to tracklinks. Should pass.
[3] Pass this URI with the biblionumber to tracklinks. Should pass now too.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:18 +00:00
Tomas Cohen Arazi 608cf1b073
Bug 23329: (follow-up) Use any instead of grep
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:18 +00:00
Nick Clemens e11b1e6d3c
Bug 23329: Only redirect tracklinks.pl to urls contained in records
Bug 19487 limited redirection to urls contained in a record/item if we were tracking.
We should probably limit forwarding if not tracking as well.
Additionally, if we don't have a soucre, let's not forward

To test:
 0 - Set TrackClicks syspref to 'Don't track'
 1 - Hit localhost:8080/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com
 2 - You get forwarded to google
 3 - Set TrackClicks to 'Track anonymously'
 4 - You get a 404
 5 - Apply patch
 6 - Hit localhost:8080/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com
 7 - You get a 404
 8 - Set TrackClicks syspref to 'Don't track'
 9 - Hit localhost:8080/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com&biblionumber=1
     Choose a biblionumber that exists
10 - You get a 404
11 - Add http://www.google.com to the 856$u of the record used above
12 - Hit localhost:8080/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com&biblionumber=1
13 - You are redirected
14 - Confirm redirection and 404 as expected with other settings of TrackClicks

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:18 +00:00
Magnus Enger d20c9ff588
Bug 22543: Prevent "back and refresh attack"
To reproduce and test:
- Log into the OPAC, you are taken to /cgi-bin/koha/opac-user.pl
- Log out, you are taken to /cgi-bin/koha/opac-main.pl?logout.x=1
- Click "Back", you are taken to /cgi-bin/koha/opac-user.pl
- Reload the page, you see an error like "Confirm new submission
  of form"
- Reload the page again and confirm the submission of the form
- You are now logged in to the OPAC again!
- Log out again
- Apply this patch
- Log in to the OPAC, you are taken to /cgi-bin/koha/opac-user.pl
- Log out, you are taken to /cgi-bin/koha/opac-main.pl?logout.x=1
- Click back, you are taken to /cgi-bin/koha/opac-user.pl
- No matter how many times you reload /cgi-bin/koha/opac-user.pl,
  you should not see anything other than the login form.
- Check that Self Check Out still works as it should, by making
  sure you have a user with self_check permissions, then setting
  WebBasedSelfCheck, AutoSelfCheckAllowed, AutoSelfCheckID and
  AutoSelfCheckPass appropriately. Then visit
  /cgi-bin/koha/sco/sco-main.pl and verify everything works as
  expected.

The messages and errors pages you see related to resubmitting the
form might differ from the ones described here, depending on what
browser you use. I tested in Chromium 76.0.x.

This fix was originally proposed by LMSCloud:
74a7fe0f0c

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:18 +00:00
Jonathan Druart 5a8f202cb2
Bug 23451: Fix other similar wrong filterings
Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:18 +00:00
Jonathan Druart 9f10889c85
Bug 23451: Prevent XSS vulnerabilities in opac-imageviewer.pl
And certainly in other sripts as it is in opac-bottom.inc

Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2019-11-27 11:30:18 +00:00