Commit Graph

28253 Commits

Author SHA1 Message Date
Jonathan Druart dbee200409 Bug 18349: SCO - Do not trust the confirmed flag
The "confirmed" flag is used to know if that user confirmed a situation
that needs a confirmation.
But if the issue/renew is impossible the CanBookBeIssued and the
'impossible flags' should be checked.

Otherwise a patron can checkout and renew bypassing the circulation
rules (Understand 'no limit' here...)

Test plan:
Want to renew?
Checkin $barcode, then
/cgi-bin/koha/sco/sco-main.pl?patronid=$cardnumber&barcode=$barcode&confirmed=1&op=checkout

Want to bypass the checkin?
Same url...

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 85bd15a83f)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-16 13:29:10 +02:00
David Kuhn 0a26e824ae Bug 17309 - Renewing and HomeOrHoldingBranch syspref
The AddRenewal subroutine currently uses the circulation rules for the branch
stored in the Issues table (which is the holding branch) when calculating the new due date.

This patch replaces using the branch from the Issues table with the branch
specified by the HomeOrHoldingBranch syspref.

To test:
1. Set up 2 branches, Branch1 and Branch2
2. Set up a loan rule in Branch1 for DVDs with a 21 day loan period and a
   21 day renewal period.
3. Set up a loan rule in Branch2 for DVDs with a 14 day loan period and a
   14 day renewal period.
4. Checkout a DVD belonging to Branch1 while logged into Branch2. It will
   receive the correct 21 day loan period.
5. Renewing the same DVD while logged into either Branch1 or Branch2
   will give a 14 day due date, rather than 21 days.
6. Checkout a DVD belonging to Branch2 while logged into Branch1. It will
   receive the correct 14 day loan period.
7. Renewing the same DVD while logged into either Branch1 or Branch2
   will give a 21 day due date, rather than 14 days.
8. Apply the patch and repeat steps 4-7. The correct due date should be given
   when the item is renewed, regardless of where it is checked out or renewed.

This update removes reassignment of $branch variable.

Signed-off-by: Cédric Vita <cedric.vita@dracenie.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 7d35bdf58a)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-16 13:18:16 +02:00
Fridolin Somers dbd6ec62a4 Bug 18329 - Batch record deletion broken
Hie, Tools > Batch record deletion seems broken.
Any deletion returns error :
Bibliographic record YYY was not deleted. An error occurred. (The error was: {UNKNOWN}: DBD::mysql::db begin_work failed: Already in a transaction at /usr/share/perl5/DBIx/Class/Storage/DBI.pm line 1560. at /home/koha/src/C4/Biblio.pm line 3468 , see the Koha log file for more information).

Looks like it is because of Bug 18242 which added a transaction  in C4::Biblio::_koha_delete_biblio_metadata : $schema->txn_do.
The script batch_delete_records created a transaction with $dbh->{AutoCommit} = 0;

This patch fixes by using also Koha::Schema in batch_delete_records to manage transaction.
It also removes "$dbh->{RaiseError} = 1", this behavior is managed in Koha::Database.

Test plan :
 - Go to Staff interface : Tools > Batch record deletion
 - Enter a few existing biblionumbers
 - Click on "Continue"
 - Click on "Delete selected records"
=> Without patch you get a DB error
=> With patch you get confirmation message
 - Try to get the biblios to confirm they are deleted : /cgi-bin/koha/catalogue/detail.pl?biblionumber=xxx
 - Test with and without Plack

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 0f32bd9999)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-10 23:47:05 +02:00
Jonathan Druart a59f056631 Bug 18266: Fix internal error when paying fine for lost item without.. item
If a fine is created for a lost item but the itemnumber is not supplied,
the system will return it.
The item should not be mark as returned if there is no item linked to
the fine.

Test plan:
1. Turn StoreLastBorrower on
2. Create a manual invoice for a lost item, do not supply a barcode
3. Pay the fines 'Pay fines > Pay'

=> Without this patch applied you get
Can't call method "last_returned_by" on an undefined value at
/home/marc/koha/C4/Circulation.pm line 2188.

=> With this patch applied, you must not get the error.
2017-04-10 23:45:29 +02:00
Jonathan Druart ad24c194bd Bug 18242: 16.11.x adaptation - Old::Checkouts vs OldIssues 2017-04-10 23:39:30 +02:00
Jonathan Druart 2f77044f63 Bug 18242: [SOLUTION 2]Handle correctly move to old_issues
The table old_issues has a primary key defined on the issue_id column.
This issue_id comes from the issues table when an item is checked in.

In some case the value of issue_id already exists in the table

Basically this happens when an item is returned and mysqld is restarted:
The auto increment value for issues.issue_id will be reset to
MAX(issue_id)+1 (which is the value of the last entry of old_issues).
See also the description of bug 18003 for more informations.

In this solution the change is done at code level instead of DB
structure: If old_issues.issue_id already exists before moving from
the issues table, the issue_id is updated (not on cascade for
accountlines.issue_id, should it?) before the move.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
(cherry picked from commit 7aa0808ff2)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-10 23:38:56 +02:00
Jonathan Druart 6bf6a53b86 Bug 18242: [SOLUTION 2]Add tests
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
(cherry picked from commit 48b1328ebe)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-10 23:38:42 +02:00
Christopher Brannon 74949be55a Bug 17346: Make checkin column hidable
To test:
1) Go to columns_settings.pl --> Circulation --> issues-table and note that you cannot change the settings for checkin.
2) Go to columns_settings.pl --> Patrons --> issues-table and note that you cannot change the settings for checkin.
3) Apply the patch.
4) Go to both tables again and note that you can now change the settings.

Followed test plan, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 9098a4d3fa)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-10 23:35:04 +02:00
Luke Honiss 9668331d42 Bug 17945 - Breadcrumbs broken on opac-serial-issues.pl
==TEST PLAN==
1) Make a subscription with a record
2) Search and view the record in OPAC
3) Click on the subscription tab and click more details
4) The breadcrumb will say 'Detals for' without the record name
5) Apply patch
6) Refresh the page
7) The breadcrumb will display the name of the record

(fixed small error)

Signed-off-by: Sonia BOUIS <sonia.bouis@univ-lyon3.fr>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 39bcba540a)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-02 19:44:43 +02:00
Marc Véron 3db9848f1a Bug 18263: Make use of syspref 'CurrencyFormat' for Account and Pay fines tables
On Home > Patrons > Accounts for... and Home > Patrons > Pay fines for...,
make the amounts display as defined in syspref 'CurrencyFormat'

To test:
- Apply patch
- Give a patron a high fine or credit (e.g. 12345.67)
- Got to pages Home > Patrons > Accounts for... and
  Home > Patrons > Pay fines
- Verify that amounts display following syspref 'CurrencyFormat'
  (e.g. 12'345.67 for syspref set to 360'000.00 (CH)

Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit db467287d1)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-02 19:37:06 +02:00
Grace McKenzie d24293bab4 Bug 17290 - Standardize on "Patron Categories"
We need to standardize on terminology, this changes all instances of
patron types to be patron categories.  To text, just view the patch

Signed-off-by: Cédric Vita <cedric.vita@dracenie.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 9a4fd7b270)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-02 19:33:44 +02:00
Marc Véron df19ffde65 Bug 18307 - Branchname is no longer displayed in subscription tab view
This patch restores the branchname in OPAC subscription detail view.
Additionally, it adds the subscriptons count to the tab title to make
it consistent with the other tab titles.

To test:
- Search a subscription in OPAC catalog
- Go to Subscriptions tab (see screenshot in initial comment)
- Verify that library name does not display
- Apply patch
- Verify that library name displays properly in Subscriptons tab
- Verify that the tab title displays the subscriptions count
  e.g.: Subscriptions (2)

Signed-off-by: Claire Gravely <claire_gravely@hotmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit c6463c258f)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-02 19:32:35 +02:00
Jonathan Druart 168a10de25 Bug 18209: Add default, 'Actions' and fix case
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit f14de0007c)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-02 19:31:32 +02:00
Blou 0a3b7777bb Bug 18209 - Patron's card manage.pl page is not fully translatable
The headers of the tables displayed in patroncards/manage.tt are hardcoded in the .pl and thus cannot be translated.

This simple fix reuse the translate_card_element tool already in the code to make the strings translatable.

Applied patch and verified that table headers on manage.pl display the same as before.
Signed-off-by: Marc Véron <veron@veron.ch>

Re-tested, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit bb1492e9f6)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-02 19:31:02 +02:00
Marcel de Rooy b8c232dd37 Bug 18019: [QA Follow-up] Also catch the delete from authorities detail
Good catch from Jonathan. See comment11.
Authorities detail should pass a CSRF token to authorities-home when
deleting a record without linked biblios.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Passing the token with GET is not a good way to do, but nothing quick to
replace that.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit d2ee53fb5f)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-02 19:18:25 +02:00
Marcel de Rooy 3090a89b83 Bug 18019: Add CSRF protection to authorities-home.pl (op==delete)
Without this patch, it is possible to delete authority records with URL
manipulation.
Like: /cgi-bin/koha/authorities/authorities-home.pl?op=delete&authid=[XXX]

Test plan:
[1] Go to Authorities. Search for some authorities (without links).
[2] Delete an authority. Should work.
[3] Apply patch.
[4] Construct an URL like above to delete another authority. Should fail.
    Under Plack this results in an internal server error, the log tells
    you: Wrong CSRF token.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Amended the test plan.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 5a7dc0749f)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-02 19:18:12 +02:00
Nick Clemens 29526afcef Bug 12972 - Transfer slip and transfer message (blue box) can conflict
Instead of passing the homebranch to the slip, let's pass
TransferWaitingAt (the value we display)

To test:
1 - Check in an item that will initiate a transfer (hold or automatic
        item return)
2 - Note the transfer message and receipt match
3 - Remove the reason for transfer (bot don't cancel transfer)
    i.e. cancel hold or change homebranch of item to current library
4 - Check the item in again
5 - Note the message displays the transfer destination and the slip
shows the homebranch
6 - Apply patch
7 - Repeat 5 but note slip and message match
8 - Test any edge cases for correctness
9 - sign off

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit f454013ec9)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-02 19:16:59 +02:00
Marcel de Rooy b4ef4f4e3b Bug 7728: [QA Follow-up] Fix POD whitespace
Resolves complaints from qa tools.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 53f2b56fa1)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-02 19:14:25 +02:00
Julian Maurice a07565870d Bug 7728: QA fixes
- Remove useless comments
- Use Koha::Objects::find instead of Koha::Objects::search

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit c26afc2568)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-02 19:14:07 +02:00
Paul Poulain 85da774d43 Bug 7728: Adding unit test ReNewSubscription.t
Test plan:
 * run without the patch, the test will fail
 * run with the patch, the test will pass

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit d79a264b69)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-02 19:13:50 +02:00
Paul Poulain 30cfdb9096 Bug 7728: Fix subs history end date consistency
Without this patch, there is an inconsistency in subscriptions:
 * a new subscription has no history end date set (as expected)
 * if you renew it, a date is set.

This patch removes the setting of the history end date during renewal

Test plan:
 * create a subscription, go to subscription-detail.pl page, tab "Summary". No History end date is set
 * renew the subscription => a date has been set
 * apply the patch
 * create another subscription
 * renew it => no history end date has been set
 * sign-off

Signed-off-by: beroud <isabelle.beroud@univ-lyon3.fr>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 1843ee148b)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-02 19:13:32 +02:00
Marc Véron da9371a1d6 Bug 18244: Patron card creator does not take in account fields with underscore (B_address etc.)
Fields with underscore like B_address do not print on patron cards.

To reproduce:
- Create patron card layout using fields with underscore in their name
  (e.g. <surname><B_address> )
- Print (export) patron card
- Verify that fields without underscore are replaced by their value,
  but fields with underscore do not replace but show the field name

To test:
- Apply patch
- Try to reproduce and verify that fields with underscore are replace
  as expected

Signed-off-by: Christopher Brannon <cbrannon@cdalibrary.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit a723de2ae0)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-02 19:10:11 +02:00
Marcel de Rooy 92ddd4bbc7 Bug 14535: Update the supplier filter too
The combobox on the left side of late orders is filled by sub
GetBooksellersWithLateOrders. The same change as in the first patch
must be made here to include suppliers with late orders without a
price.

Bonus: Sort the list.

Test plan:
[1] Run t/db_dependent/Bookseller.t.
[2] Go to late orders. Use the filter on suppliers.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Srdjan <srdjan@catalyst.net.nz>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit b76eac9ca2)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-02 19:09:06 +02:00
Marcel de Rooy f305629f14 Bug 14535: Late orders does not show orders with price = 0
This patch removes the filter of unitpricesupplier <> 0 and
unitpricelib <> 0 from GetLateOrders as used in lateorders.pl.
This allows you to claim late orders without a price entered.

Test plan:
[1] Run t/db_dependent/Acquisition.t
[2] Check if you see an order with no price in lateorders.pl. (If needed,
    remove prices from a few orders.)

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Srdjan <srdjan@catalyst.net.nz>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 71f267fd3f)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-02 19:08:48 +02:00
Marcel de Rooy dbb0b4a4b0 Bug 12913: [QA Follow-up] Reword 'change item status' and add zero status
The zero status should be added in @notforloans. It is a legitimate status
for available books. The zero status description can be translated in
the template.
The 'Change item status' is confusing. We mean that we saw a notforloan
status that we do not expect (read: does not exist in the table).

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 664d653417)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-02 19:02:48 +02:00
Fridolin Somers f75915336c Bug 12913 - wrong inventory results when notforloan filter is not used
In inventory tool, there is a test on scanned items notforloan value : if the value is not one of authorized values, the inventory results displays the problem "Change item status".
The bug is that if notforloan filter is not used, the notforloan values array is not filled and so all scanned items are marked with this problem.

Test plan :
- Check you have in default framework an item subfield mapped with items.notforloan and with an authorized value catergory, for example 'NOTFORLOAN'
- Check the authorized value category has at least value '0'
- Create a new value in this category, for example '9'
- Create a biblio with default framework
- Create an item with barcode='000AAA1', callnumber='ZZZAAA1' and notforloan=0
- Create an item with barcode='000AAA2', callnumber='ZZZAAA2' and notforloan=9
- Delete new value created above, for example '9'
- Create a file 'barecodes.txt' containing 2 lines '000AAA1' and '000AAA2'
- Go to inventory tool : /cgi-bin/koha/tools/inventory.pl
- Choose file in 'Barcode file'
- Enter item callnumber between 'ZZZ' and 'ZZZZ'
- Check 'Compare barcodes list to results'
- Submit
=> without patch, you get 2 results with problem 'Change item status' even for item with notforloan=0
=> with patch, you get 1 result with 'Change item status' on item with notforloan=9

Signed-off-by: Nick Clemens <nick@quecheelibrary.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 358fb744c7)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-02 19:02:32 +02:00
Benjamin Rokseth a36ee908dc Bug 17758 - SIP checkin does not handle holds correctly
This patch updates SIP checkin to use reserve_id as param, to fix regression
introduced by Bug 14695.

To test:

Given 1 patron and 1 biblio with two items attached:

1) create two record level holds on one biblio on same user
Using SIP client or telnet:
2) checkin item x on pickup branch, observe item is waiting and hold 1 is filled
3) checkin item y on pickup branch, observe item y now is waiting and x is available
4) apply this patch and repeat 1-3, now expected behaviour should be
   that both holds are filled and both items waiting

Signed-off-by: Srdjan <srdjan@catalyst.net.nz>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 72de37e24b)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-02 18:52:56 +02:00
Nick Clemens 75ac234177 Bug 17995 - HOLDPLACED notice should have access to the reserves table
To test:
1 - Add reserves.reservenotes to HOLDPLACED message
2 - Enable emailLibrarianWhenHoldIsPlaced OpacHoldNotes sysprefs
3 - Place a hold via OPAC with a note
4 - view the messagequeue and note the reservenotes is blank
5 - Apply patch
6 - Place a hold with a note
7 - view the messagequeue and note the reservenotes is populated

Followed test plan, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
(cherry picked from commit 3b794b1312)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-02 18:47:55 +02:00
Jonathan Druart 34565e7f7d Bug 18022: Fix possible crash if CircAutoPrintQuickSlip=clear screen
If CircAutoPrintQuickSlip is set to clear screen, the $borrowernumber variable
is reset but $borrower.
In 16.11.x and before that causes the app to crash, because
$borrower->{flags} is set to a hashref by GetMemberDetails, if
$borrowernumber is set.

This case is better handled in master (17.05) but side-effects could
happen: if $borrowernumber is reset, $borrower should be reset too.

The way to drive this behaviour is terrible and lot of things should be
done to clean this area. This patch is a quick and easy fix to make it
backportable easily.

Test plan:
On master, no change expected
On 16.11 and before:
0. Set CircAutoPrintQuickSlip=clear screen
1. Create a new patron
2. Set permission for this patron to 'reservesforothers' (or something
else).
3. Go on the circulation tab
4. Do not fill the barcode input and submit
=> Without this patch you will get an error
Can't use string ("64") as a HASH ref while "strict refs"....
=> With this patch apply you will get a blank screen (expected
behaviour).

I would recommend to test this patch with the other value of
CircAutoPrintQuickSlip as well
2017-04-02 18:45:41 +02:00
Jonathan Druart e2f860386d Bug 18058: Allow borrower_message_preferences to be truncated
borrower_message_preferences cannot be truncated because of the foreign.
DBMS fails with
  "Cannot truncate a table referenced in a foreign key constraint"

To avoid that we should remove the FK check and truncate the other table
as well.

I am wondering if we really need a truncate here
  DELETE FROM borrower_message_preferences;
should do the job, but leave it as it because of the param name.

Test plan
  perl misc/maintenance/borrowers-force-messaging-defaults --doit --truncate
Should no longer raise the error message

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit dd88c8f710)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-02 18:12:24 +02:00
Jonathan Druart c69868de49 Bug 18124: Change the calls to generate and check CSRF tokens
The parameter change in Koha::Token should be applied to the calling
scripts.

Test plan:
Confirm that the different forms of the scripts modified by this patch
still work correctly.

Test the problematic behavior:
Open 2 tabs with in same user's session, go on the edit patron page
(memberentry.pl).
Log out and log in from the other tab.
Submit the form
=> Wrong CSRF token should be raised

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 574d48362d)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-02 18:03:53 +02:00
Marcel de Rooy bead88a8bc Bug 18124: [Follow-up] Handle default parameters in a sub
Adds a internal routine to handle default values for the parameters
id and secret.
Also adds a parameter session_id for generate_csrf and check_csrf. This
session parameter is combined with the id parameter when generating or
checking a token.

Test plan:
Run t/Token.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 7190593d9d)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-02 18:00:45 +02:00
Jonathan Druart 7da5ac1bbb Bug 18124: Restrict CSRF token to user's session
Currently the CSRF token generated is based on the borrowernumber, and
is valid across user's session.
We need to restrict the CSRF token to the current session.

With this patch the CSRF token is generated concatenating the id
(borrowernumber) and the CGISESSID cookie.

Test plan:
Run t/Token.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 3562816dd1)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-02 18:00:27 +02:00
Jonathan Druart 07e2f4fedc Bug 18312: Fix export unless a file is supplied
Bug 18087 breaks export unless a file is supplied.

Can't use an undefined value as a HASH reference at
/home/vagrant/kohaclone/tools/export.pl line 75.

Test plan:
Export records using a file of id that is not a valid file (not txt or
csv)
Export records using a valid file
Export records without supplying a file

=> The export should work or fail as expected.

Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 8dad1582c1)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-04-02 17:58:52 +02:00
Koha instance kohadev-koha e94bf3f00f Add release notes to 16.11.06 release 2017-03-27 13:25:27 +00:00
Katrin Fischer 36dcb5e23d Merge remote-tracking branch 'transl/16.11.06-translate-20170327' into 16.11.x 2017-03-27 13:16:40 +00:00
Katrin Fischer 380b63208c Increment version for 16.11.06 release 2017-03-27 13:14:15 +00:00
root 0ce712b552 Translation updates for Koha 16.11.06 2017-03-27 10:11:27 -03:00
Jonathan Druart ab23d13683 Bug 15854: Use a READ and WRITE LOCK on message_queue
To make sure we will not never get a race conditions for these kinds of
notices, we need to add a LOCK on the message_queue table.

This does not smell the best way to do that, but I faced deadlock issues
when I tried to use "UPDATE FOR"

https://dev.mysql.com/doc/refman/5.7/en/innodb-locking-reads.html
https://dev.mysql.com/doc/refman/5.7/en/lock-tables.html
https://dev.mysql.com/doc/refman/5.7/en/commit.html

To test this patch, or another solution, you need to apply manually this
change:

         my $message = C4::Message->find_last_message($borrower, $type, $mtt);
         unless ( $message ) {
+            sleep(1);
             C4::Message->enqueue($letter, $borrower, $mtt);
         } else {

And repeat the test plan from first patch.
Do not forget to truncate the message_queue table.

Followed test plans, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
(cherry picked from commit be156d9ad9)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-03-26 21:09:46 +00:00
Jonathan Druart bdae6c9492 Bug 15854: Simplify the code to limit race conditions
There is an obvious race condition when CHECKIN and RENEWAL are
generated from circulation.pl calling svc/renew or svc/checkin in AJAX.

The 2 first queries will try to get the id of the last message
(find_last_message) and if it does not exist, they will insert it.
Theorically that could be lead to have several "digest" messages for a
given patron.
I did not recreate more than 2 messages, from the third one at least one
of the two firsts existed in the DB already.

This patch just simplifies the code to make the SELECT and INSERT or
UPDATE closer and limit the race condition possibilities.

Test plan:
0. Set RenewalSendNotice and circ rules to have a lot of renewals available
1. Use batch checkouts (or one by one) to check out several items to a
patron
2. Empty message_queue (at least of this patron)
3. Renew them all at once ("select all" link, "renew or check in"
button)
4. Check the message_queue
Without this patch you have lot of chances to faced a race condition and
get at least 2 messages for the same patron. This is not expected, we
expect 1 digest with all the messages.
With this patch apply you have lot of chances not to face it, but it's
not 100% safe as we do not use a mechanism to lock the table at the DBMS
level.

Tested both patches together, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
(cherry picked from commit 607b14516a)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-03-26 21:09:35 +00:00
Colin Campbell 108853352a Bug 17605: [STABLE] Add currency to orders generated by quotes
Sets the vendors currency in the edi generated order
The currency used is agreed between vendor and library
and the value in the quote is optional

Edifact potentially allows the currency to be overwitten
by specifying another currency in the CUX segment but
we know currently of no supplier doing this

Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
2017-03-26 21:08:30 +00:00
Marcel de Rooy 74fe3f5cda Bug 18010: Remove potential exposure from gettemplate
A similar bad template check from C4::Auth::get_template_and_user
should be applied in C4::Templates::gettemplate.

Before this patch it would be possible to expose files like:
my $template = C4::Templates::gettemplate(
    '/etc/passwd', 'intranet', CGI::new, 1
);
print $template->output;

Note that the is_plugin flag in the above call is the culprit. This patch
provides a quick security fix without touching get_template_and_user, and
can be backported to stable branches.
I will provide an enhanced and centralized check on report 17989, also
removing the is_plugin flag.

Note: We allow .pref here too for use in admin/preferences.pl.

Test plan:
[1] Run t/db_dependent/Auth.t (triggering get_template_and_user and
    gettemplate).
[2] Run t/db_dependent/Templates.t again (see first test plan).
    The tests should no longer fail.
[3] Open a page on opac or intranet.
[4] Open a systempreferences tab.
[5] Add a book to the cart and send it ([opac-]sendbasket uses gettemplate).

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
(cherry picked from commit fbbd4b40f0)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-03-26 21:05:43 +00:00
Marcel de Rooy 1161a67476 Bug 18010: Unit test for gettemplate
A trivial test, similar to the ones in Auth.t.
Without the check in gettemplate (added in the second patch), the passwd
file will be exposed and the test fails.

Test plan:
Run t/db_dependent/Templates.t without second patch. The two tests in the
last subtest should fail.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
(cherry picked from commit 5508897d5a)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Conflicts:
	t/db_dependent/Templates.t
2017-03-26 21:05:25 +00:00
Jonathan Druart fd1f24487a Bug 18028: Remove outdated install_misc directory
This directory is no longer maintained and contain outdated information
on how to install Koha.
On the Internet there are tutos using them and that can create confusion
to new user (yes it could be confusing as well to execute a file that
does no longer exist).

NOTE: last tweak was mid 2016, but before that 2015. So I agree with
      the deletion.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
(cherry picked from commit a6f50cbcb9)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-03-26 21:00:08 +00:00
Jonathan Druart fac1ccd9b2 Bug 18069: Remove residue of rebuild_zebra -x
Bug 17731 removed the -x option of rebuild_zebra but koha-rebuild-zebra
still cals the script with this option.

"Warning: You passed -x which is already the default and is now deprecated"

Test plan:
sudo koha-rebuild-zebra -f
should no longer raise the warning

Signed-off-by: Mason James <mtj@kohaaloha.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
(cherry picked from commit fe898bc641)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-03-26 20:54:58 +00:00
Jonathan Druart b294550ac6 Bug 18094: Only search in searchable patron attributes if searching in standard fields
Test plan:
- Add a new patron attrbute and mark it searchable
- Populate a new patron with 'potato' in that field
- Add/edit another patron to have email potato@invalidemail.com'
- Perform a patron search with query 'potato' (in standard fields)
=> Both patrons are returned
- Perform a patron search with filters 'Email' and query 'potato'
=> Only 1 patron is returned and you are redirected to the patron detail page.

Followed test plan, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
(cherry picked from commit 5823d4ca6a)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-03-26 20:53:33 +00:00
Jonathan Druart 50483ff17c Bug 18094: Add tests to highlight the problem
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
(cherry picked from commit f86500351a)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-03-26 20:53:24 +00:00
Marc Véron 95bccfbbb8 Bug 18246: Patron card creator: Unit not always displays properly in layouts
To reproduce:

1) Create a new layout
2) Select an unit in "Units selection"
3) Save
4) Edit layout again
5) Select other unit, e.g. 'SI Centimeter'
6) Save
7) Repeat
8) Edit again
Error: Latest unit seems to stick and can no longer be changed, because
in units drop down, multiple untis are marked as selected.

To test:
1) Apply patch
2) Repeat steps above, verify that value for units always display as expected.

Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
(cherry picked from commit 37da40b323)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-03-26 20:50:52 +00:00
Marc Véron 34a91f6e3d Bug 8603: Patron card creator - 'Barcode Type' doesn't stick in layouts
To reproduce:

1. Make a new layout
2. Tick "Print card number as barcode"
3. Change 'Barcode Type' to anything other than Code39
4. Save
5. Edit it again
6. Its back to Code39

To test:
1. Apply patch
2. Repeat steps above
3. Verify that 'Barcode type' is selected as expected

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

https://bugs.koha-community.org/show_bug.cgi?id=18063

https://bugs.koha-community.org/show_bug.cgi?id=8063

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
(cherry picked from commit 20ad341eef)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-03-26 20:49:30 +00:00
Nicolas Legrand 4f57d8ccea Bug 18150 - CanItemBeReserved doesn't work with (IndependentBranches AND ! canreservefromotherbranches)
The variable $item used to be a hash, but at the end of the function,
it's a Koha object. As $item->{homebranch} doesn't yield anything and
should be $item->homebranch. It prevents people using different
branches without holds between branches from placing a hold on an item
they should be able to place hold on.

Test plan:

1. Before patch

  a. with IndependantBranches off
  b. try to place hold on an item you should be able to place hold on
  c. it should work
  d. put IndependantBranches on and canreservefromotherbranches off
  e. shouldn't work

2. after patches redo steps from (1) and everything should be working
fine.

Signed-off-by: Christopher Brannon <cbrannon@cdalibrary.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Note: Item is fetched twice, it's not necessary. But out of the scope of
this patch.

Signed-off-by: Brendan A Gallagher <brendan@bywatersolutions.com>
(cherry picked from commit f79cf7930d)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
2017-03-26 20:29:58 +00:00