It's set to true by default now
https://datatables.net/upgrade/2#Deferred-rendering
"""
For this reason, deferRender's default value has been changed to be enabled (true) in DataTables 2.
"""
Signed-off-by: Jake Deery <jake.deery@ptfs-europe.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Change in behaviour: now the filters are displayed automatically on the
"Lost items" report.
Note: We need bug 37238 for the item search.
Signed-off-by: Jake Deery <jake.deery@ptfs-europe.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
I don't really understand why this was not required on bug 33484, but
here this patch fixes a bug with the filters and the column visibility:
Fix: select an option in a column filter then hide a column that is before.
Signed-off-by: Jake Deery <jake.deery@ptfs-europe.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Also centralize and clean the delay code to use DT's debounce.
I have commented the code from initComplete as I don't think it's the
right place. Maybe we need to add it for other table, but then it should
be added when we init DT.
Removed blacklist_keys to keep code clean, could be re-added later if we
really need it.
Signed-off-by: Jake Deery <jake.deery@ptfs-europe.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Replace fnGetColumnData
No need delay, it's not ajax
Signed-off-by: Jake Deery <jake.deery@ptfs-europe.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
t/db_dependent/Serials/ReNewSubscription.t .. Value not allowed for auto_incr id in Aqbookseller at /kohadevbox/koha/t/lib/TestBuilder.pm line 402.
Null value for subscriptionid in Subscriptionhistory not allowed at /kohadevbox/koha/t/lib/TestBuilder.pm line 415.
Can't call method "enddate" on an undefined value at t/db_dependent/Serials/ReNewSubscription.t line 102.
It's failing when no vendor with id=1 in DB.
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Sponsored-by: Orex Digital
Signed-off-by: Alexandre Noel <alexandre.noel@inlibro.com>
Signed-off-by: Hugo Agud <hagud@orex.es>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Sponsored-by: Orex Digital
Signed-off-by: Hugo Agud <hagud@orex.es>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Sponsored-by: Orex Digital
Signed-off-by: Hugo Agud <hagud@orex.es>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Also add an icon for the "Cite" entry.
Sponsored-by: Orex Digital
Signed-off-by: Hugo Agud <hagud@orex.es>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Hugo Agud <hagud@orex.es>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Hugo Agud <hagud@orex.es>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Hugo Agud <hagud@orex.es>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Adds a "cite" option in the tools menu in OPAC detail page for easy citations.
Test plan:
1. Apply this patch
2. Got to OPAC detail page
3. In the tools menu to the right, click the new "Cite" link
4. A modal should appear with four different citation styles (APA, Chicago,
Harvard, MLA)
Sponsored-by: Regionbibliotek Halland / County library of Halland
Signed-off-by: Nicole Engard <nengard@bywatersolutions.com>
Signed-off-by: Hugo Agud <hagud@orex.es>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
When user inputs were appended directly to the barcode table, the values were not properly escaped, allowing potential XSS attacks. This patch ensures that user inputs are sanitized and safely added to the DOM using .text() and .attr() methods to prevent script injection.
To test:
Enable the "SelfCheckInModule".
Open the barcode input form.
Enter a barcode with HTML or script tags.
Without the patch, observe that the script is executed.
Apply the patch.
Repeat step 2.
Verify that the input is escaped and no script execution occurs.
Check that the barcode is properly appended to the table.
Documentation:
No updates required.
Sponsored-by: KillerRabbitAos
Signed-off-by: Bo Gustavsson <bosse@gustavsson.one>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This change removes the Koha version number from the OPAC generator
metadata.
Test plan:
0. Apply patch
1. Enable syspref SelfCheckInModule
2. Visit /cgi-bin/koha/opac-main.pl and confirm meta tag doesn't
include version number
3. Visit /cgi-bin/koha/sci/sci-main.pl and confirm meta tag doesn't
include version number
4. Visit /cgi-bin/koha/sco/sco-main.pl) and confirm meta tag doesn't
include version number
5. Click "Help" and confirm meta tag doesn't include version number
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch adds formula=empty to:
- Koha::ERM::EUsage::SushiCounter::_build_COUNTER_report_file()
Updated 2024-09-26: Earlier version also removed unnecessary
use of formula=empty from two places.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
The system is vulnerable to Formula Injection attacks as the data
stored within the database and exported as CSV/Excel is not being
sanitized or validated against implanted formula payloads
This patch modifies all uses of Text::CSV and derived classes to pass
the "formula" parameter with value of "empty" which replaces formulas
by empty string.
Test Plan:
1) Apply this patch
2) For guided_reports.pl, attempt to export CSV where you've set a column to a formula somehow
( such as "=1+3" )
3) Export that CSV file
4) Note the formula has not been exported
5) Repeat this plan for the remaining scripts that export CSV files
where users can define the outputted data
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Fixed two conflicts. I have tested that this works as advertised on:
- Reports (Download > Comma separated text (.csv)) [Text::CSV::Encoded]
- Circulation > Overdues > Download file of all overdues [Text::CSV_XS]
- misc/export_borrowers.pl [Text::CSV]
This covers all modules used, and both GUI and command line.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Change none to empty in the commit message ! None is the default,
doing nothing. Empty clears the formulas.
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
To test:
1. Change the `dateformat` syspref to any value other than `us`(shows as mm/dd/yyyy)
2. Run:
$ ktd --shell
k$ prove t/db_dependent/SIP/Transaction.t
=> FAIL: Tests fail because of the resulting string containing an unexpected date format.
3. Repeat 1-2 with other formats
=> FAIL: SAme
4. Choose `us`
5. Repeat 2
=> SUCCESS: It passes
6. Apply this patch
7. Repeat 2
=> SUCCESS: Tests pass!
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
You are permitted to delete ILL batch statuses that you (rather than the
system) add, but the UI didn't get the CSRF memo about delete ops needing to
be POSTs with op="cud-delete", so it still uses a GET of ?op="delete" and
fails.
Test plan:
1. Set the preference ILLModule to 'Enable'
2. Administration - Interlibrary loan batch statuses - New batch status
3. Give it a name, an uppercase code, and Save
4. Click the Delete button to the right of your new status
5. The page is blank, and if you navigate back to Interlibrary loan batch
statuses, you'll see that yours was not deleted
6. Apply patch, reload page
7. Click the Delete button to the right of your new status, verify it is
deleted
Sponsored-by: Chetco Community Public Library
Signed-off-by: Sam Sowanick <sam.sowanick@corvallisoregon.gov>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This does not belong here, but raised to me here, so attaching on this
one.
This feels like it's coming from bug 33484, but those tests were passing
after it has been pushed.
This patch fixes the following error:
Error while executing command: stale element reference: The element reference of <input type="text"> is stale; either the element is no longer attached to the DOM, it is not in the current frame context, or the document has been refreshed at /usr/share/perl5/Selenium/Remote/Driver.pm line 411.
Since bug 33484 the row with the filters is redrawn on table redraw. So
we need to search for the input every time the table is redrawn.
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This follow up enhances the sip_cli_emulator.pl to use start-item and/or end-item as params. With these new params the original test plan can be extended:
Test plan:
a) create several manual invoices for patron 23529000035676 : http://localhost:8081/cgi-bin/koha/members/maninvoice.pl?borrowernumber=19
b) run
perl misc/sip_cli_emulator.pl -a 127.0.0.1 -p 6001 -su term1 -sp term1 -l CPL --patron 23529000035676 -m patron_information -s " Y " --start-item=1 --end-item=2
to get fine 1 and 2 or
perl misc/sip_cli_emulator.pl -a 127.0.0.1 -p 6001 -su term1 -sp term1 -l CPL --patron 23529000035676 -m patron_information -s " Y " --start-item=3 --end-item=3
to retrieve fine 3
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
The original implementation of fine items was accidently overwritten with this patch. This follow up reverts these changes but keeps additional improvements that were also part of this patch.
These are:
- Returning the active currency as part of the response (BH)
- Fixing the number of items in the response which are specified in BP and BQ when other items as fine items are requested.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch makes several changes to make the updated forms more
consistent with how other pages work:
- Form labels should have ":" after them.
- Form fields should have a hint when they are required.
- Required fields should not be indicated with an asterisk.
- In the OPAC, <select> should have a "form-select" class if the form is
otherwise being styled with Bootstrap classes.
- Primary submit buttons should have a "btn btn-primary" class.
- The Font Awesome 6 icon for a delete operation is "fa-trash-can."
- Error messages should be wrapped in <div class="alert alert-warning">.
- All language strings in JS files should be wrapped in __('').
- Terminology: "Library" instead of "Branch," "Patron" instead of
"Member."
Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
It was missing in the JS that adds new empty custom fields.
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
In the prepopulated fields when editing item metadata that had custom
fields (tt generated). So it's consistent when adding new empty fields
(done in JS)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
qa tools throw:
ill_text_input_field: not found
But I believe this is a false positive.
We can clearly see it working by going to:
http://localhost:8080/cgi-bin/koha/opac-illrequests.pl?op=add_form&backend=Standard
And picking 'DVD' or any other type.
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This refactors the code for more DRY
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Jonathan Druart
Thibaud Guillot
Jan Kissig
Martin Renvoize
Martin Stenberg
Artur
David Cook
Magnus Enger
Kyle M Hall
Tomas Cohen Arazi
Phil Ringnalda
Nick Clemens
Pedro Amorim
Katrin Fischer
Owen Leonard
Victor Grousset/tuxayo