Signed-off-by: Trevor Diamond <trevor.diamond@mainlib.org>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
To test:
1. APPLY PATCH, updatedatabase, restart_all
2. Go to your circulation rules and do the following:
-Automatic renewal: Yes
-No renewal before: 5
-No automatic renewal before: 5
-Renewal period: 5
3. Set ManualRenewalPeriodBase to "the old due date of the checkout".
4. Set AutomaticRenewalPeriodBase to "current date".
5. Check out an item and set the due date to 2 days from today
6. Attempt to manually renewal the item.
7. Notice the new date is calculated based on the old checkout date.
8. Check out an item another item and set the due date to 2 days from today.
9. Run `perl /kohadevbox/koha/misc/cronjobs/automatic_renewals.pl -c -v`
10. Notice the new date is calculated based on the current date.
11. Set ManualRenewalPeriodBase to "current date".
12. Set AutomaticRenewalPeriodBase to "the old due date of the checkout".
13. Check out an item and set the due date to 2 days from today
14. Attempt to manually renewal the item.
15. Notice the new date is calculated based on the current date.
16. Check out an item another item and set the due date to 2 days from today.
17. Run `perl /kohadevbox/koha/misc/cronjobs/automatic_renewals.pl -c -v`
18. Notice the new date is calculated based on the old checkout date.
Signed-off-by: Trevor Diamond <trevor.diamond@mainlib.org>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Trevor Diamond <trevor.diamond@mainlib.org>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
When a specific item is selected in the booking modal, the end date
disable logic was incorrectly checking if ALL bookable items were
unavailable before disabling a date. This meant dates with existing
bookings for the selected item remained selectable if other items
were available.
Now when a specific item is selected (booking_item_id != 0), the
logic checks if that specific item is in the unavailable_items list.
The "all items unavailable" check is only used when "Any item" is
selected.
This aligns the end date selection behavior with the start date
selection behavior, which already correctly checks only the selected
item.
Signed-off-by: Kristi Krueger <kkrueger@cuyahogalibrary.org>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit fixes a bug where the trail period was preventing selection
of the maximum end date allowed by circulation rules, even when there
were no booking conflicts in the trail period.
The Problem:
============
The hover logic in place_booking.js checked if ANY disabled date fell
within the trail period and would prevent selection. However, dates can
be disabled for multiple reasons:
1. They conflict with an existing booking (correct reason to disable)
2. They are beyond the maxDate set by circulation rules (incorrect!)
3. They are in the past
When hovering over the max selectable end date, the trail period would
extend beyond the maxDate. Those dates were disabled by flatpickr
automatically, and the code incorrectly interpreted this as a booking
conflict, preventing selection of the otherwise valid max date.
The Fix:
========
Modified the trail period conflict check (lines 995-1005) to only
consider dates that are within the max date range. Disabled dates
beyond the maxDate are now ignored when checking for trail conflicts.
Before:
if (elemDate.isAfter(trailStart) && elemDate.isSameOrBefore(trailEnd)) {
trailDisable = true;
}
After:
if (elemDate.isAfter(trailStart) && elemDate.isSameOrBefore(trailEnd)) {
const maxDate = periodPicker.config.maxDate ? dayjs(periodPicker.config.maxDate) : null;
if (!maxDate || elemDate.isSameOrBefore(maxDate)) {
trailDisable = true;
}
}
This ensures trail periods only prevent selection when they conflict
with actual bookings, not when they extend beyond the circulation
rules' maximum date.
Signed-off-by: Kristi Krueger <kkrueger@cuyahogalibrary.org>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit adds comprehensive Cypress tests for the lead and trail period
functionality in the bookings modal date picker. These tests validate the
hover effects, conflict detection, and date selection constraints.
The tests use cy.clock() to fix "today" to June 10, 2026, enabling
deterministic testing without date arithmetic complications.
Test coverage includes:
- Lead period visual hints (CSS classes on hover)
- Lead period conflict prevention with past dates
- Lead period conflict prevention with existing bookings
- Trail period visual hints (CSS classes on hover)
- Trail period conflict prevention with existing bookings
- Max date selection when trail period is clear (no false restrictions)
Test setup:
- Fixed date: June 10, 2026
- Lead period: 2 days
- Trail period: 3 days
- Issue length: 3 days with 2 renewals of 2 days each
- Max booking period: 7 days
- Blocker booking: June 25-27 (tests both lead and trail conflicts)
Test phases:
1. Hover June 13 - lead period (June 11-12) is clear, no leadDisable
2. Select June 13, hover June 16 - trail period (June 17-19) is clear
3a. Hover June 11 - lead period includes past date (June 9), leadDisable
3b. Hover June 29 - lead period overlaps blocker (June 27), leadDisable
4. Select June 20, hover June 23 - trail overlaps blocker, trailDisable
5. Select June 13, hover June 20 (max) - trail is clear, selectable
Signed-off-by: Kristi Krueger <kkrueger@cuyahogalibrary.org>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Changes the descriptions of the holds history and checkout history permissions to say "view" rather than "viewing"
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
To test:
1 - enable IntranetReadingHistoryHolds system preference
2 - make some holds for a patron, confirm you can see Holds History in the patron record when logged in as a superlibrarian
3 - log in as a non-superlibrarian with edit_borrowers permission, confirm you can see holds history in pthe patron record
4 - apply patch, updatedatabase, restat_all
5 - confirm you can see holds history as a superlibrarian
6 - confirm your non-superlibrarian from step 3 was given view_holds_history permission and can view holds history
7 - remove view_holds_history permission from your user, confirm you can no longer access holds history
Signed-off-by: Trevor Diamond <trevor.diamond@mainlib.org>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
To test:
1. Create or modify a staff user with edit_borrowers permssion enabled ( Staff A )
2. Create or modify a staff user without edit_borrowers permssion enabled ( Staff B )
3. Ensure the "intranetreadinghistory" syspref is enabled
4. Check out an assortment of items to any patron
5. Apply patch, update_database, then restart_all
6. Check the permissions of the staff user A and ensure that they have been automatically assigned the new "view_checkout_history" permission
7. Check the permissions of the staff user B and ensure that they have NOT been automatically assigned the new "view_checkout_history" permission
8. View the same patron and ensure you can still see their checkout history as Staff A and as a superlibrarain
9. Disable the "intranetreadinghistory" syspref and remove the "view_checkout_history" permission of the staff user
Signed-off-by: Trevor Diamond <trevor.diamond@mainlib.org>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch adds the required DBIx::Class relationship definitions to
Koha::Schema::Result::ErmAgreementPeriod to support additional fields
and extended attributes on agreement periods.
Two has_many relationships are added:
- additional_field_values: links to all additional field values
- extended_attributes: alias for additional_field_values
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch enables additional fields functionality for agreement periods
in the ERM (Electronic Resource Management) module, allowing libraries
to define custom metadata fields for agreement period records.
Changes include:
- Update Koha::AdditionalField to support erm_agreement_periods table
- Modify API definitions to include extended_attributes in responses
- Add erm_agreement_periods option to additional fields admin interface
- Enhance Vue components to display and manage additional field values
- Update ShowElement component to handle period-specific attributes
Test plan:
1. Navigate to Administration > Additional fields
2. Create new fields for "Agreement periods"
3. Edit an ERM agreement and add/edit period information
4. Verify additional fields appear and can be populated
5. Confirm values are saved and displayed correctly
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
To test:
1. Make sure SMSSendDriver system preference is enabled
2. In staff client, navigate to patron details of any patron
3. From the members menu toolbar, click "Add Message"
4. Under "Add a message for", select "SMS - sms number of patron"
5. Write a custom message
6. Click "Save"
7. Navigate to patron's Notices tab
8. Observe a new notice titled "SMS added by a librarian"
9. Click it
10. Observe the content you wrote in step 5
11. Repeat steps 2-4
12. Select predefined patron notice. If you don't have one,
navigate to Tools > Notices and slips > New notice > Patrons (custom message)
and add content under sms delivery option
13. Repeat steps 6-7
14. Observe your custom message in the notices table
15. Observe your custom message content when you click the notice
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Charlie Arthur <carthur@slolibrary.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch updates templates for OPAC popup windows to add a
fixed "navbar" element at the top of the window with the main heading at
an "X" button which closes the window.
To test, apply the patch and rebuild the OPAC CSS. On each page, test
that the pop-up window looks correct. Confirm that the "X" in the upper
right works to close the window.
- Clear your browser cache if necessary.
- Make sure the opacbookbag, virtualshelves, and OPACComments system
preferences are enabled.
- Log in to the OPAC and perform a catalog search which will return
multiple results.
- Select multiple results and choose Add to list -> New list.
- Test Add to list -> More lists
- Test Add to list -> (existing list)
- View the contents of a list.
- Click "Send list" and test the process of sending a list.
- Return to your catalog search results and add multiple items to the
cart.
- View the cart
- Test the "Send" option
- With the OPACComments system preferenc enabled, view the detail page
for a bibliographic record.
- Under the comments tab, click "Post your comments..."
Sponsored-by: Athens County Public Libraries
Signed-off-by: Ludovic Julien <ludovic.julien@inLibro.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This table also has a show past holidays button, we need the same fix
To test:
1 - Spam holidays into both tables
You can run the SQL commands below a few times each
INSERT INTO special_holidays (branchcode, day, month, year,isexception, title,description) VALUES ('CPL',FLOOR(RAND() * 28) + 1,FLOOR(RAND() * 12) + 1,FLOOR(RAND() * 6) + 2020,0,LEFT(UUID(),8),UUID());
INSERT INTO special_holidays (branchcode, day, month, year,isexception, title,description) VALUES ('CPL',FLOOR(RAND() * 28) + 1,FLOOR(RAND() * 12) + 1,FLOOR(RAND() * 6) + 2020,1,LEFT(UUID(),8),UUID());
2 - Go to Tools->Calendar
3 - Click 'Show past holidays' for exceptions and unique holidays
4 - Confirm checking and unchecking work on both tables
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Test plan:
1. Go to Tools → Calendar.
2. Select a branch with past unique holidays.
If you don't have past closed days: Create a new holiday in a past
month or so.
3. In the Unique holidays section, enable "Show past entries".
4. Past entries are not displayed.
5. Apply patch:
6. Repeat the steps above.
7. Past entries are displayed immediately.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch adds hold fee information display in the staff client's hold
request interface, bringing it to feature parity with the OPAC.
The OPAC already shows patrons the fee that will be charged for placing
a hold, but the staff client did not display this information when staff
place holds on behalf of patrons. This creates a transparency gap where
staff cannot inform patrons about potential charges.
Changes:
- Import GetReserveFee function in reserve/request.pl
- Calculate reserve charges for each biblio record
- Display fee information in both single and multi-hold interfaces
- Show appropriate messaging based on HoldFeeMode system preference
- Use consistent formatting with currency display
Test Plan:
1. Set up hold fees:
- Go to Administration > Patron categories
- Edit a patron category and set a "Hold fee" (e.g., 1.00)
- Ensure HoldFeeMode system preference is set (default: "only if all
items are checked out and the record has at least one")
2. Test single hold with fee display:
- Go to a bibliographic record
- Click "Place hold"
- Find a patron from the category with hold fees configured
- Verify fee information displays after the title:
* Shows "Note: [Patron Name] will be charged a hold fee of $1.00
for placing this hold" when the HoldFeeMode is set to "any time
a hold is placed"
* Or "...when they collect this item" if HoldFeeMode is set to "any
time a hold is collected"
3. Test multi-hold with fee display:
- Ensure 'DisplayMultiPlaceHold' preference is set to 'Enable'
- Search the catalog
- On the search results page, select multiple biblios and click
'Place hold'
- Search for the same patron
- In the confirmation table, verify each record shows:
* "Hold fee: $1.00 (charged when placed)" in the Information column
* Or "(charged when collected)" based on HoldFeeMode
4. Test no fee display:
- Repeat tests with a patron from a category with no hold fee
- Verify no fee information is displayed
5. Test different HoldFeeMode settings:
- Change HoldFeeMode system preference to 'any_time_is_collected'
- Verify messaging changes to "when they collect this item"
- Test with 'not_always' mode and verify fee only shows when appropriate
6. Verify existing functionality:
- Ensure hold placement still works normally
- Verify all other hold interface elements remain unchanged
- Test that holds are properly placed with or without fees
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This is needed or else the OPAC still throws the 'malformed query string' mentioned on the original test plan.
This is because the fix from bug 40865 was only applied to intra datatables.js not the OPAC datatables.
I don't know why this fixes it for the OPAC, but it does.
Joubu, thoughts?
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
1) Install the unpaywall plugin:
https://github.com/openfifth/koha-plugin-ill-avail-unpaywall/releases/tag/1.0.2
2) Configure an email address on the plugin configuration (I believe any email address should work):
<staff_url>/cgi-bin/koha/plugins/run.pl?class=Koha%3A%3APlugin%3A%3ACom%3A%3APTFSEurope%3A%3AAvailabilityUnpaywall&method=configure
3) Enable ILLModule and ILLCheckAvailability sys prefs
4) Create a new ILL request, visit:
<staff_url>/cgi-bin/koha/ill/ill-requests.pl?method=create&backend=Standard
5) Pick type: journal article and enter the DOI: 10.1002/bjs.1800621024
6) Enter a cardnumber e.g. '42' for koha user and any library.
7) Notice the availability screen never renders, a console error is logged on the browser.
8) Apply patch. Refresh. Repeat.
This appears to have stopped working after bug 26553. Using git bisect, after bug 26553 (cc09868152), this started returning a 'bad request: malformed query string' because query params were being sent to the plugin API route (which doesn't consider them). Bug 40865 then fixed the bad request error, but resulted in the console error we see now, which is fixed by this patch.
ajax.dataSrc appears to now be returning an additional level of 'data' due to datatables upgrade (?), this patch changes the dataSrc override to be more in line with the example doc at https://datatables.net/reference/option/ajax.dataSrc
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
1) Install the following dummy backend plugin:
https://github.com/openfifth/koha-ill-backend-plugin/releases/tag/v2.0.9
2) Sys prefs preparation: Enable ILLModule, ILLOpacUnauthenticatedRequest and check PluginBackend on AutoILLBackendPriority
3) Logout, create a new Unauthenticated ILL request on the OPAC, visit:
<opac_url>/cgi-bin/koha/opac-illrequests.pl?op=create&backend=Standard
4) Fill in the mandatory top fields (first name, last name, email address and library)
5) Pick 'Book' for type and enter 'green' in title. This will cause the dummy plugin to be available in the AutoILL logic.
6) At the bottom of the form, on the "Verification" captcha, purposely input a wrong captcha e.g. '123'
7) Click 'Create'. Notice an odd looking form is presented, this is the dummy backend form, but it should present the 'Standard' form when using AutoILLBackendPriority as that was also the form we were presented with originally.
This happens because currently it's the backend that delegates back to Koha what template to render. When using AutoILLBackendPriority, however, Koha should handle this template delegation instead and present the Standard form.
8) Apply patches. Repeat test plan. Notice that now on step 7 you get the correct form, and error message (coming from Standard, as expected when using AutoILLBackendPriority).
9) Input the correct captcha this time
10) Confirm the created request landed in the PluginBackend backend.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
'request' is unblessed in this context. get_type doesnt exist/work.
Test plan:
1) Enable ILLModule and ILLOpacUnauthenticatedRequest
2) Logout, place an OPAC unauthenticated ILL request, visit:
<opac_url>/cgi-bin/koha/opac-illrequests.pl?backend=Standard&op=add_form
3) Input all mandatory fields. Click 'Create'.
4) Notice 'Request type' shows as 'N/A'. This will always be the case regardless of type you pick.
5) Apply patch. Repeat. Notice 'Request type' now shows as expected.
Signed-off-by: Richard Bridgen <richard.bridgen@nhs.net>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
To test:
1. Create a record as a collection with leader 007 set to c
2. Add some items on the same branch to the bundle
3. Check one item in
4. Observe that you get a 404 error and the item is not removed from
the bundle
5. Apply the patch
6. Repeat step 3
7. Observe that the item is correctly removed (unlinked) from the
bundle
8. Sign off
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
To remove the unnecessary entries from the DB
Signed-off-by: Ayoub Glizi-Vicioso <ayoub.glizi-vicioso@inLibro.com>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
0 days in advance means that the notice should not be sent.
This patch contains the pl/pm changes: we set to null if 0 is passed,
and do not insert a row in borrower_message_transport_preferences
Test plan:
0. Do not apply the patches
1. Create some entries with email and days in advance = 0
2. Create some entries with email and days in advance > 0
3. Apply the patches
4. Run the updatedatabase script
=> The rows in borrower_message_transport_preferences have been removed
for days in advance = 0
5. Edit some messaging preferences
=> 0 has been replace with a blank entry
=> checkboxes are disabled when blank is selected
6. Save
=> No new entry in borrower_message_transport_preferences is blank is
selected
7. advance_notices.pl still works correctly
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Syspref "hidepatronname" currently hides guarantors
name on memberentry.pl. This is inconsistent since name isn't hidden e.g. on moremember.pl and staff
can already see patrons other personal information
during edit.
To test:
1) Disable syspref "hidepatronname"
2) Edit guarantee patrons information
=> Field "Guarantor" only shows guarantors cardnumber (or
is empty if guarantor has no cardnumber)
3) Apply patch
=> Guarantors name is now displayed (as a hyperlink)
Also confirm hidepatronname still works as expected
on other pages (holds table, items detail page etc.).
Sponsored-by: Koha-Suomi Oy
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
To test you should check the behavior of forms which have sets of "from"
and "to" dates. It shouldn't be possible to select a "to" date which is
before the "from" date. For example:
- Overdues report
- Invoice search
In some cases we need to check that the fields work correctly when the
"from" date is already filled:
- Editing vendor issues
- Editing a budget
- Duplicating a subscription
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Olli Kautonen <bhm503@myy.haaga-helia.fi>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
The main ERM route was missing a 'name' property, causing the
navigation store to treat it as an external path (.pl extension).
This resulted in breadcrumb links using href instead of router-link,
causing unwanted page reloads.
To test:
1. Navigate to ERM module
2. Go to any sub-section (Agreements, Licenses, etc.)
3. Click on 'E-resource management' in the breadcrumb
=> FAIL: Notice the page reloads!
4. Apply the patch
5. Repeat steps 1-3
=> SUCCES: Verify the page doesn't reload and navigation works smoothly
6. Sign off :-D
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch corrects the capitalization of the phrases "RDA carrier,"
"RDA content," and "RDA media," found in several UNIMARC cataloging
plugins.
To test you could edit subfields in a MARC framework to activate each
affected plugin, but I think the change is simple enough to be checked
by examining the patch.
Sponsored-by: Athens County Public Libraries
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This change prevents CSRF on opac-patron-consent.pl by
adding checking of the "op".
Test plan:
0. Apply the patch and koha-plack --restart kohadev
1. Set system preference PrivacyPolicyConsent to "permissive"
2. Log into the OPAC and go to this path:
/cgi-bin/koha/opac-patron-consent.pl?check_GDPR_PROCESSING=1
3. Note that it doesn't change the consent
4. Go to this path:
/cgi-bin/koha/opac-patron-consent.pl?check_GDPR_PROCESSING=0
5. Note that it doesn't change the consent
6. Click the "Yes" radio button and click "Save"
7. Note it changes the consent to Yes
8. Click the "No" radio button and click "Save"
9. Note it changes the consent to No
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch moves the cypress test into the Acqusitions folder to help keep t/cypress/integration organized as we add more tests.
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This change validates the displayby parameter in suggestion.pl
in order to prevent SQL injection.
Test plan:
0. Do not apply the patch
1. Log into the staff interface
2. Visit the path /cgi-bin/koha/suggestion/suggestion.pl?
op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version))
3. Notice a 500 error is generated
4. In the error logs, the MySQL version number will appear
5. Apply the patch
6. koha-plack --restart kohadev
7. Visit the path /cgi-bin/koha/suggestion/suggestion.pl?
op=else&displayby=status+AND+EXTRACTVALUE(1,CONCAT(0x7e,@@version))
8. Notice that no error is generated
9. Try each of the "Organize by" options on the left nav bar
10. Note that none of them generate an error and that the option is
retained after clicking "Go"
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch updates patron-title.inc which generates the output of patron
names throughout Koha. Some whitespace is added to the display of
borrowers.othernames and spaces removed from the maybe_span WRAPPER.
To test, apply the patch and create or edit a patron in the staff
client.
- Add a value to all the name fields: Surname, first name, preferred
name, middle name, and other name.
- Save the patron and check the display of their name on the patron
detail page. The name in the page heading and sidebar should have
correct spacing.
- Place a hold for that patron to be picked up at the logged-in library.
- Go to Circulation -> Holds to pull and confirm that the patron name is
displayed correctly (this tests the display when the format is
lastname, firstname).
- Edit the same patron and change its category to an organizational one
(Inter-Library Loan, Library, or School in the sample data).
- View the same pages listed above and confirm that the name displays
correctly.
Sponsored-by: Athens County Public Libraries
Signed-off-by: Manvi <manvisharma1006@gmail.com>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Lucas Gass
Martin Renvoize
Andrew Fuerste Henry
David Flater
Jonathan Druart
Matt Blenkinsop
Lari Taskula
Owen Leonard
Nick Clemens
Slava Shishkin
Pedro Amorim
Aya Khallaf
Paul Derscheid
Emmi Takkinen
Tomas Cohen Arazi
David Cook
Lisette Scheer