The test in SendCirculationAlert is extended by adding an env var
called KOHA_NO_TABLE_LOCKS. If this var is set to a true value,
the table locking is skipped too.
This is useful when running a test without prove. The variable could be
set in a shell profile.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Mason James <mtj@kohaaloha.com>
(cherry picked from commit 15751085e9)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
From the MySQL doc:
"LOCK TABLES is not transaction-safe and implicitly commits any active transaction before attempting to lock the tables."
If the LOCK/UNLOCK statements are executed from tests, the current transaction will be committed.
To avoid that we need to guess if this code is execute from testsa or not (yes it is a bit hacky)
Better ideas are welcome!
Another fix would have been to revert
commit be156d9ad9
Bug 15854: Use a READ and WRITE LOCK on message_queue
but theorically a race is still possible.
Existing tests seem to be safe, to test this patch you will need new
tests from bug 17964.
Test plan:
prove t/db_dependent/Letters/TemplateToolkit.t
twice, and notice that changes have been comitted.
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Mason James <mtj@kohaaloha.com>
(cherry picked from commit a2d5655093)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Intranet search results displays due date from item onloan.
This should use the TT date plugin.
Test plan :
- set syspref dateformat not on yyyy-mm-dd, for example dd/mm/yyyy
- checkout an item
- at intranet, perform a search where you see the item
=> You must see : "date due : dd/mm/yyyy"
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Mason James <mtj@kohaaloha.com>
(cherry picked from commit a6315f2f44)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Implemented invalid_username_or_password template
variable being handed to Auth.tt. Removed indentation
changes and modification to return value of checkpw
Test plan:
See comment #2
Alternative test plan:
- Clear session cookies or close / open your browser
- Go to [MY SERVER]/cgi-bin/koha/installer/install.pl
- Verify that message appears if wrong username/pw provided
- Verify that you can log in with databas administrator account
Tested with alternative test plan, works as expected. Title and
description in commit message adapted.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 87eb80136d)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 8c17314ef8)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
In aqbudgetperiods.pl a commented line is removed that contains a
wrong userenv hash key. Should be branch instead of branchcode.
In aqbudgets GetBudgetHierarchy is called with the same wrong userenv
hash key. Should be userenv->{branch}.
This made another bug visible: if you call GetBudgetHierarchy with a
branch and without owner, the where clause should take into account
that the branchcode can be empty (not null).
Test plan:
[1] Run Budgets.t
[2] Run aqbudgets.pl from Administration
[3] Add the show_mine=1 parameter in the URL
[4] Change owner of one of the funds and repeat step 2 and 3.
t/Budgets.t returns green. Followed test plan, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 476179a123)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 3079f7a725)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
The error codes come from CanBookBeIssued.
The warnings speak for themselves. Note that the GNA message is similar
to the one used in opac-user.tt (gonenoaddress is translated to the patron
as contact information not up-to-date).
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 392641ff1e)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 0424099416)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Empty tags should be removed, and message id
Note that not all error codes are covered here.
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit b61f73c488)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit fee024e18a)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Only RENEW_ISSUE should not be considered as blocker, others should.
Note that this code is not robust and the whole script as well as the
return of CanBookBeIssued should be rewrittent completely.
We need a small patch to easy backport to stable releases
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit d28d5a280d)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 9062df67c8)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
I guess this code was never called before...
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 6b75e5b478)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 3ef6f12596)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
The "confirmed" flag is used to know if that user confirmed a situation
that needs a confirmation.
But if the issue/renew is impossible the CanBookBeIssued and the
'impossible flags' should be checked.
Otherwise a patron can checkout and renew bypassing the circulation
rules (Understand 'no limit' here...)
Test plan:
Want to renew?
Checkin $barcode, then
/cgi-bin/koha/sco/sco-main.pl?patronid=$cardnumber&barcode=$barcode&confirmed=1&op=checkout
Want to bypass the checkin?
Same url...
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 85bd15a83f)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit dbee200409)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
The AddRenewal subroutine currently uses the circulation rules for the branch
stored in the Issues table (which is the holding branch) when calculating the new due date.
This patch replaces using the branch from the Issues table with the branch
specified by the HomeOrHoldingBranch syspref.
To test:
1. Set up 2 branches, Branch1 and Branch2
2. Set up a loan rule in Branch1 for DVDs with a 21 day loan period and a
21 day renewal period.
3. Set up a loan rule in Branch2 for DVDs with a 14 day loan period and a
14 day renewal period.
4. Checkout a DVD belonging to Branch1 while logged into Branch2. It will
receive the correct 21 day loan period.
5. Renewing the same DVD while logged into either Branch1 or Branch2
will give a 14 day due date, rather than 21 days.
6. Checkout a DVD belonging to Branch2 while logged into Branch1. It will
receive the correct 14 day loan period.
7. Renewing the same DVD while logged into either Branch1 or Branch2
will give a 21 day due date, rather than 14 days.
8. Apply the patch and repeat steps 4-7. The correct due date should be given
when the item is renewed, regardless of where it is checked out or renewed.
This update removes reassignment of $branch variable.
Signed-off-by: Cédric Vita <cedric.vita@dracenie.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 7d35bdf58a)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 0a26e824ae)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
If a fine is created for a lost item but the itemnumber is not supplied,
the system will return it.
The item should not be mark as returned if there is no item linked to
the fine.
Test plan:
1. Turn StoreLastBorrower on
2. Create a manual invoice for a lost item, do not supply a barcode
3. Pay the fines 'Pay fines > Pay'
=> Without this patch applied you get
Can't call method "last_returned_by" on an undefined value at
/home/marc/koha/C4/Circulation.pm line 2188.
=> With this patch applied, you must not get the error.
(cherry picked from commit a59f056631)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
==TEST PLAN==
1) Make a subscription with a record
2) Search and view the record in OPAC
3) Click on the subscription tab and click more details
4) The breadcrumb will say 'Detals for' without the record name
5) Apply patch
6) Refresh the page
7) The breadcrumb will display the name of the record
(fixed small error)
Signed-off-by: Sonia BOUIS <sonia.bouis@univ-lyon3.fr>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 39bcba540a)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 9668331d42)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
On Home > Patrons > Accounts for... and Home > Patrons > Pay fines for...,
make the amounts display as defined in syspref 'CurrencyFormat'
To test:
- Apply patch
- Give a patron a high fine or credit (e.g. 12345.67)
- Got to pages Home > Patrons > Accounts for... and
Home > Patrons > Pay fines
- Verify that amounts display following syspref 'CurrencyFormat'
(e.g. 12'345.67 for syspref set to 360'000.00 (CH)
Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit db467287d1)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 3db9848f1a)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit f14de0007c)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 168a10de25)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
The headers of the tables displayed in patroncards/manage.tt are hardcoded in the .pl and thus cannot be translated.
This simple fix reuse the translate_card_element tool already in the code to make the strings translatable.
Applied patch and verified that table headers on manage.pl display the same as before.
Signed-off-by: Marc Véron <veron@veron.ch>
Re-tested, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit bb1492e9f6)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 0a3b7777bb)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Instead of passing the homebranch to the slip, let's pass
TransferWaitingAt (the value we display)
To test:
1 - Check in an item that will initiate a transfer (hold or automatic
item return)
2 - Note the transfer message and receipt match
3 - Remove the reason for transfer (bot don't cancel transfer)
i.e. cancel hold or change homebranch of item to current library
4 - Check the item in again
5 - Note the message displays the transfer destination and the slip
shows the homebranch
6 - Apply patch
7 - Repeat 5 but note slip and message match
8 - Test any edge cases for correctness
9 - sign off
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit f454013ec9)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 29526afcef)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Resolves complaints from qa tools.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 53f2b56fa1)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit b4ef4f4e3b)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Without this patch, there is an inconsistency in subscriptions:
* a new subscription has no history end date set (as expected)
* if you renew it, a date is set.
This patch removes the setting of the history end date during renewal
Test plan:
* create a subscription, go to subscription-detail.pl page, tab "Summary". No History end date is set
* renew the subscription => a date has been set
* apply the patch
* create another subscription
* renew it => no history end date has been set
* sign-off
Signed-off-by: beroud <isabelle.beroud@univ-lyon3.fr>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 1843ee148b)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 30cfdb9096)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Fields with underscore like B_address do not print on patron cards.
To reproduce:
- Create patron card layout using fields with underscore in their name
(e.g. <surname><B_address> )
- Print (export) patron card
- Verify that fields without underscore are replaced by their value,
but fields with underscore do not replace but show the field name
To test:
- Apply patch
- Try to reproduce and verify that fields with underscore are replace
as expected
Signed-off-by: Christopher Brannon <cbrannon@cdalibrary.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit a723de2ae0)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit da9371a1d6)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
The combobox on the left side of late orders is filled by sub
GetBooksellersWithLateOrders. The same change as in the first patch
must be made here to include suppliers with late orders without a
price.
Bonus: Sort the list.
Test plan:
[1] Run t/db_dependent/Bookseller.t.
[2] Go to late orders. Use the filter on suppliers.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Srdjan <srdjan@catalyst.net.nz>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit b76eac9ca2)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 92ddd4bbc7)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
This patch removes the filter of unitpricesupplier <> 0 and
unitpricelib <> 0 from GetLateOrders as used in lateorders.pl.
This allows you to claim late orders without a price entered.
Test plan:
[1] Run t/db_dependent/Acquisition.t
[2] Check if you see an order with no price in lateorders.pl. (If needed,
remove prices from a few orders.)
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Srdjan <srdjan@catalyst.net.nz>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 71f267fd3f)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit f305629f14)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
The zero status should be added in @notforloans. It is a legitimate status
for available books. The zero status description can be translated in
the template.
The 'Change item status' is confusing. We mean that we saw a notforloan
status that we do not expect (read: does not exist in the table).
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 664d653417)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit dbb0b4a4b0)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
In inventory tool, there is a test on scanned items notforloan value : if the value is not one of authorized values, the inventory results displays the problem "Change item status".
The bug is that if notforloan filter is not used, the notforloan values array is not filled and so all scanned items are marked with this problem.
Test plan :
- Check you have in default framework an item subfield mapped with items.notforloan and with an authorized value catergory, for example 'NOTFORLOAN'
- Check the authorized value category has at least value '0'
- Create a new value in this category, for example '9'
- Create a biblio with default framework
- Create an item with barcode='000AAA1', callnumber='ZZZAAA1' and notforloan=0
- Create an item with barcode='000AAA2', callnumber='ZZZAAA2' and notforloan=9
- Delete new value created above, for example '9'
- Create a file 'barecodes.txt' containing 2 lines '000AAA1' and '000AAA2'
- Go to inventory tool : /cgi-bin/koha/tools/inventory.pl
- Choose file in 'Barcode file'
- Enter item callnumber between 'ZZZ' and 'ZZZZ'
- Check 'Compare barcodes list to results'
- Submit
=> without patch, you get 2 results with problem 'Change item status' even for item with notforloan=0
=> with patch, you get 1 result with 'Change item status' on item with notforloan=9
Signed-off-by: Nick Clemens <nick@quecheelibrary.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 358fb744c7)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit f75915336c)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
To test:
1 - Add reserves.reservenotes to HOLDPLACED message
2 - Enable emailLibrarianWhenHoldIsPlaced OpacHoldNotes sysprefs
3 - Place a hold via OPAC with a note
4 - view the messagequeue and note the reservenotes is blank
5 - Apply patch
6 - Place a hold with a note
7 - view the messagequeue and note the reservenotes is populated
Followed test plan, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
(cherry picked from commit 3b794b1312)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 75ac234177)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
If CircAutoPrintQuickSlip is set to clear screen, the $borrowernumber variable
is reset but $borrower.
In 16.11.x and before that causes the app to crash, because
$borrower->{flags} is set to a hashref by GetMemberDetails, if
$borrowernumber is set.
This case is better handled in master (17.05) but side-effects could
happen: if $borrowernumber is reset, $borrower should be reset too.
The way to drive this behaviour is terrible and lot of things should be
done to clean this area. This patch is a quick and easy fix to make it
backportable easily.
Test plan:
On master, no change expected
On 16.11 and before:
0. Set CircAutoPrintQuickSlip=clear screen
1. Create a new patron
2. Set permission for this patron to 'reservesforothers' (or something
else).
3. Go on the circulation tab
4. Do not fill the barcode input and submit
=> Without this patch you will get an error
Can't use string ("64") as a HASH ref while "strict refs"....
=> With this patch apply you will get a blank screen (expected
behaviour).
I would recommend to test this patch with the other value of
CircAutoPrintQuickSlip as well
(cherry picked from commit 34565e7f7d)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
borrower_message_preferences cannot be truncated because of the foreign.
DBMS fails with
"Cannot truncate a table referenced in a foreign key constraint"
To avoid that we should remove the FK check and truncate the other table
as well.
I am wondering if we really need a truncate here
DELETE FROM borrower_message_preferences;
should do the job, but leave it as it because of the param name.
Test plan
perl misc/maintenance/borrowers-force-messaging-defaults --doit --truncate
Should no longer raise the error message
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit dd88c8f710)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit e2f860386d)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
To make sure we will not never get a race conditions for these kinds of
notices, we need to add a LOCK on the message_queue table.
This does not smell the best way to do that, but I faced deadlock issues
when I tried to use "UPDATE FOR"
https://dev.mysql.com/doc/refman/5.7/en/innodb-locking-reads.htmlhttps://dev.mysql.com/doc/refman/5.7/en/lock-tables.htmlhttps://dev.mysql.com/doc/refman/5.7/en/commit.html
To test this patch, or another solution, you need to apply manually this
change:
my $message = C4::Message->find_last_message($borrower, $type, $mtt);
unless ( $message ) {
+ sleep(1);
C4::Message->enqueue($letter, $borrower, $mtt);
} else {
And repeat the test plan from first patch.
Do not forget to truncate the message_queue table.
Followed test plans, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
(cherry picked from commit be156d9ad9)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit ab23d13683)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
There is an obvious race condition when CHECKIN and RENEWAL are
generated from circulation.pl calling svc/renew or svc/checkin in AJAX.
The 2 first queries will try to get the id of the last message
(find_last_message) and if it does not exist, they will insert it.
Theorically that could be lead to have several "digest" messages for a
given patron.
I did not recreate more than 2 messages, from the third one at least one
of the two firsts existed in the DB already.
This patch just simplifies the code to make the SELECT and INSERT or
UPDATE closer and limit the race condition possibilities.
Test plan:
0. Set RenewalSendNotice and circ rules to have a lot of renewals available
1. Use batch checkouts (or one by one) to check out several items to a
patron
2. Empty message_queue (at least of this patron)
3. Renew them all at once ("select all" link, "renew or check in"
button)
4. Check the message_queue
Without this patch you have lot of chances to faced a race condition and
get at least 2 messages for the same patron. This is not expected, we
expect 1 digest with all the messages.
With this patch apply you have lot of chances not to face it, but it's
not 100% safe as we do not use a mechanism to lock the table at the DBMS
level.
Tested both patches together, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
(cherry picked from commit 607b14516a)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit bdae6c9492)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
A similar bad template check from C4::Auth::get_template_and_user
should be applied in C4::Templates::gettemplate.
Before this patch it would be possible to expose files like:
my $template = C4::Templates::gettemplate(
'/etc/passwd', 'intranet', CGI::new, 1
);
print $template->output;
Note that the is_plugin flag in the above call is the culprit. This patch
provides a quick security fix without touching get_template_and_user, and
can be backported to stable branches.
I will provide an enhanced and centralized check on report 17989, also
removing the is_plugin flag.
Note: We allow .pref here too for use in admin/preferences.pl.
Test plan:
[1] Run t/db_dependent/Auth.t (triggering get_template_and_user and
gettemplate).
[2] Run t/db_dependent/Templates.t again (see first test plan).
The tests should no longer fail.
[3] Open a page on opac or intranet.
[4] Open a systempreferences tab.
[5] Add a book to the cart and send it ([opac-]sendbasket uses gettemplate).
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
(cherry picked from commit fbbd4b40f0)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 74fe3f5cda)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
A trivial test, similar to the ones in Auth.t.
Without the check in gettemplate (added in the second patch), the passwd
file will be exposed and the test fails.
Test plan:
Run t/db_dependent/Templates.t without second patch. The two tests in the
last subtest should fail.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
(cherry picked from commit 5508897d5a)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Conflicts:
t/db_dependent/Templates.t
(cherry picked from commit 1161a67476)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Test plan:
- Add a new patron attrbute and mark it searchable
- Populate a new patron with 'potato' in that field
- Add/edit another patron to have email potato@invalidemail.com'
- Perform a patron search with query 'potato' (in standard fields)
=> Both patrons are returned
- Perform a patron search with filters 'Email' and query 'potato'
=> Only 1 patron is returned and you are redirected to the patron detail page.
Followed test plan, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
(cherry picked from commit 5823d4ca6a)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit b294550ac6)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
To reproduce:
1) Create a new layout
2) Select an unit in "Units selection"
3) Save
4) Edit layout again
5) Select other unit, e.g. 'SI Centimeter'
6) Save
7) Repeat
8) Edit again
Error: Latest unit seems to stick and can no longer be changed, because
in units drop down, multiple untis are marked as selected.
To test:
1) Apply patch
2) Repeat steps above, verify that value for units always display as expected.
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
(cherry picked from commit 37da40b323)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 95bccfbbb8)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
To reproduce:
1. Make a new layout
2. Tick "Print card number as barcode"
3. Change 'Barcode Type' to anything other than Code39
4. Save
5. Edit it again
6. Its back to Code39
To test:
1. Apply patch
2. Repeat steps above
3. Verify that 'Barcode type' is selected as expected
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
https://bugs.koha-community.org/show_bug.cgi?id=18063https://bugs.koha-community.org/show_bug.cgi?id=8063
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
(cherry picked from commit 20ad341eef)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 34a91f6e3d)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
From opac/opac-memberentry.pl, authnotrequired is set.
That means a patron can access the page without being logged in. It is
used on this page for the self registration feature.
From C4::Auth::get_template_and_user, we have
$userid = $q_userid;
$q_userid is previously set to the 'userid' CGI param.
We end up here if authonotrequired is set AND CGISESSID does not exist.
Test plan:
- Run:
$ prove t/db_dependent/Auth.t
=> FAIL: Regression test for checkauth fails
- Apply this patch
- Run:
$ prove t/db_dependent/Auth.t
=> SUCCESS: Tests pass.
- Sign off :-D
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Charges should not include elements less than a penny/cent
they are not displayed but can be saved to the database
causing "odd" behaviour down the line
Make the routine round the resultant charge to nearest cent,
so consistent values are returned.
Removed the one case where it was rounded post call.
Although the main danger is values generated by the discount
calculation apply the rounding to all returned charges in case
the item charge is defined using the 3rd or 4th decimal
places.
NOTE: prove -v t/db_dependent/Circulation.t triggers the change.
Though, all the returned amounts are 0.00 only.
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit d84ed89557)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 661e6389c9)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Test Plan
1: Turn on SearchMyLibraryFirst and go into OPAC
2: It should say Search (in <Branch Code> Only)
3: Apply patch and refresh page. It should now say Search (in <Library Name> only)
Sponsored-by: Catalyst IT
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit e8420b5d80)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 0b1311ccb9)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
To test:
1) Log into OPAC and go to change your password
2) Enter current password incorrectly and click Submit changes
3) Observe error message and typo 're-set'
4) Apply patch and refresh page
5) May be asked to resend data - if so, click Resend, if not, repeat
step 2
6) Observe error message and corrected spelling of 'reset'
Sponsored-by: Catalyst IT
Signed-off-by: Caitlin Goodger <caitlingoodger.student@wegc.school.nz>
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 86ec263b2d)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 56938d7630)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
This is a follow-up to my previous patch. This fixes it on the OPAC and
the previous one was from the intranet
Test Plan
1: Add multiple urls to a biblographic record
2: Add the biblographic record to a list and then email it from the OPAC
3: See that the links are broken and have been merged into one.
4: Apply patch
5: Send the list again and see that the links work
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Mason James <mtj@kohaaloha.com>
(cherry picked from commit e914a29788)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Test Plan
1: Add multiple urls to a biblographic record
2: Add the biblographic record to a list and then email it.
3: See that the links are broken and have been merged into one.
4: Apply patch
5: Send the list again and see that the links work
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Mason James <mtj@kohaaloha.com>
(cherry picked from commit bcbd75fba2)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Marcel de Rooy
Jonathan Druart
Fridolin Somers
Julian Maurice
root
Alex Buckley
David Kuhn
Luke Honiss
Marc Véron
Blou
Nick Clemens
Paul Poulain
Tomas Cohen Arazi
Colin Campbell
Aleisha Amohia
Caitlin Goodger