To test:
1) Apply the patch
2) run prove t/db_dependent/Circulation/CanBookBeIssued.t
--After each step, a message will be displayed in the action_logs table and in Tools > Log viewer --
Circulation -- Checking out
1) Check out an item that is age-restricted (AgeRestrictionOverride syspref)
2) Check out an item that has a “not for loan” status (AllowNotForLoanOverride syspref)
3) Check out an item that has a “lost” status (IssueLostItem syspref)
4) Check out an item to a patron who has reached the checkout limit (AllowTooManyOverride syspref)
5) Check out an item to a patron who is not allowed to borrow this item type
6) Check out an item to a patron who has unpaid fines (AllFinesNeedOverride and/or AllowFineOverride + noissuescharge sysprefs)
7) Check out an item on hold for someone else
8) Check out an item on hold ready for pickup by someone else
9) Check out an item already checked out to someone else (AutoReturnCheckedOutItems syspref)
10) Check out to a patron who has restrictions
Circulation -- Checking in
11) Ignore a hold upon check in
12) Ignore a hold and transfer upon check in
Circulation – Renewing
13) Renew an item on hold for someone else (AllowRenewalOnHoldOverride syspref)
14) Renew an item that has reached the maximum number of renewals (AllowRenewalLimitOverride syspref)
Holds
15) Place a hold for a patron who is not allowed to place this item type on hold (AllowHoldPolicyOverride syspref)
16) Place a hold for a patron who has reached the maximum number of holds
17) Place an item-level hold when rules dictate that this is not allowed (In circulation rules put "On shelf holds allowed" to "If any unavailable")
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch allows you to save commands that have been overridden by someone.
The patch has been updated but is not yet completed. Tests 10, 13, 14, and 17 are still not functional. Tests 15 and 16 need to be fixed as they do not display the barcode. All other tests should be functional.
To test:
--After each step, a message will be displayed in the action_logs table and in Tools > Log viewer --
Circulation -- Checking out
1) Check out an item that is age-restricted (AgeRestrictionOverride syspref)
2) Check out an item that has a “not for loan” status (AllowNotForLoanOverride syspref)
3) Check out an item that has a “lost” status (IssueLostItem syspref)
4) Check out an item to a patron who has reached the checkout limit (AllowTooManyOverride syspref)
5) Check out an item to a patron who is not allowed to borrow this item type
6) Check out an item to a patron who has unpaid fines (AllFinesNeedOverride and/or AllowFineOverride + noissuescharge sysprefs)
7) Check out an item on hold for someone else
8) Check out an item on hold ready for pickup by someone else
9) Check out an item already checked out to someone else (AutoReturnCheckedOutItems syspref)
10) Check out to a patron who has restrictions
Circulation -- Checking in
11) Ignore a hold upon check in
12) Ignore a hold and transfer upon check in
Circulation – Renewing
13) Renew an item on hold for someone else (AllowRenewalOnHoldOverride syspref)
14) Renew an item that has reached the maximum number of renewals (AllowRenewalLimitOverride syspref)
Holds
15) Place a hold for a patron who is not allowed to place this item type on hold (AllowHoldPolicyOverride syspref)
16) Place a hold for a patron who has reached the maximum number of holds
17) Place an item-level hold when rules dictate that this is not allowed (In circulation rules put "On shelf holds allowed" to "If any unavailable")
Sponsored-by: Solutions inLibro inc. <https://inlibro.com/>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch adds search_attrs to count_holds() since these get
used with CanBookBeReserved.
Test plan:
0. Apply the patch
1. prove t/db_dependent/Koha/Holds.t t/db_dependent/Reserves/HoldGroup.t t/db_dependent/Reserves.t
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch explicitly defines indexes for foreign keys.
This isn't really needed for the atomic update, but we've included
it for consistency.
It is needed in kohastructure.sql, because MySQL/MariaDB silently/implicitly
adds these indexes for foreign keys, which means that the database
audit tool will show a discrepancy between kohastructure.sql and
the installed DB schema.
Also fix a discrepancy between atomic update and kohastructure.sql
Test plan:
0. Apply the patch
1. Use both methods to update the DB schema
2. Go to http://localhost:8081/cgi-bin/koha/about.pl?tab=database
3. Note that about.pl isn't telling you to drop the indexes
for reserves_ibfk_hg and old_reserves_ibfk_hg now
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Brought to light by accessing the following page with the feature enabled:
http://localhost:8081/cgi-bin/koha/members/holdshistory.pl?borrowernumber=51
Also by running the following tests file before this patch:
t/db_dependent/api/v1/holds.t
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch makes DisplayAddHoldGroups and DisplayMultiItemHolds
work together, so that you can add multiple items to 1 hold group
from the staff detail page, the OPAC detail page, or the OPAC
search results.
Note: At this time, you can't add multiple items to a hold group
from the staff search results. This is due to the existing constraints
in request.pl
Over the last 10 years, in practice most hold groups have been formed
at the OPAC anyway.
Test plan:
__OPAC search results__
- Enable both DisplayAddHoldGroups and DisplayMultiItemHolds
- Go to http://localhost:8080/cgi-bin/koha/opac-search.pl?idx=&q=test&weight_search=1
- Choose "Gairm" and "Continuous delivery" and click "Place hold"
- Checkbox "Treat as hold group"
- Click "Show more options" for each record
- Click "A specific item" for "Continuous delivery"
- Checkbox both specific items for that title
- Press "Confirm hold"
- Note 3 holds are in the hold group
- Cancel all the holds
__OPAC detail page__
- Go to http://localhost:8080/cgi-bin/koha/opac-detail.pl?biblionumber=134
- Click "Place hold"
- Checkbox "Treat as hold group"
- Click "Show more options"
- Choose "A specific item"
- Checkbox both items
- Click "Confirm hold"
- Note 2 holds are in the hold group
- Cancel all the holds
__Staff detail page__
- Go to http://localhost:8081/cgi-bin/koha/reserve/request.pl?biblionumber=134&borrowernumber=51
- Choose "Hold a specific item"
- Checkbox "Treat as hold group"
- Checkbox both items
- Click "Place hold"
- Note 2 holds are in the hold group
- Cancel all the holds
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Bug 15516: Add ability to create and view hold groups from OPAC
This patch adds a "Treat as hold group" to opac-reserve.pl,
which lets OPAC users create a hold group which can include
1+ bibs and either bib-level holds, or item-level holds, or both.
This patch shows the item-level and bib-level holds in a hold group
for the user's holds in the OPAC. This includes both the opac-user.pl
page and the self-checkout hold display.
Bug 15516: (follow-up) Only show hold groups for multi hold in OPAC
Bug 15516: (follow-up) Only show hold groups for multi hold in staff interface
Bug 15516: Add 'DisplayAddHoldGroups' system preference to toggle ability to add titles to hold groups
These patches add the ability to create hold groups across multiple bibs in the staff interface or OPAC.
These hold groups are fulfilled by the first item checked in across the hold group.
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
It can be useful, for instance, if a library has the same title from
different publishers (so 1 title but several biblio records) but the
user only wants a copy of the book, regardless of the publisher.
Test plan:
0. Run updatedatabase.pl and misc/devel/update_dbix_class_files.pl
1. Go to intranet search, display some results, click on some checkboxes
and click on 'Place hold' button at the top of the results.
2. Search for a patron
3. Check the 'Treat as hold group' checkbox
4. Click on 'Place hold'
5. In the next screen you should see all the holds you placed with the
additional text '(part of a hold group)' in Details column.
6. Click on the "hold group" link. A modal window should appear with
the content of the hold group (a list of holds)
7. Check in an item of one of the reserved biblios and confirm the hold
8. The hold status is changed to Waiting, and all other holds are deleted.
The other holds will also be removed from the holds queue.
9. Confirm tests pass
- t/db_dependent/Koha/Holds.t
- t/db_dependent/Reserves/HoldGroup.t
Note: the "hold group" link is displayed in the following pages:
- reserve/request.pl
- circ/circulation.pl
- members/moremember.pl
- circ/pendingreserves.pl
- circ/view_holdsqueue.pl
Note: A hold group is counted as only one hold
Sponsored-by: Catalyst IT
Signed-off-by: Michal Denar <black23@gmail.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Michal Denar <black23@gmail.com>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Michal Denar <black23@gmail.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Michal Denar <black23@gmail.com>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Michal Denar <black23@gmail.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Michal Denar <black23@gmail.com>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Currently request_transfer checks for the existence of a current transfer on the item, and a new one can either be
enqueued or replace this transfer. This patch adds a check to see if the requested transfer matches an existing transfer
on the item. In the case that it does we simply return that transfer rather than create a new transfer.
This has the effect of eliminating 'WrongTransfer' generation if an item is checked in twice at the same branch, which feels correct.
To test:
1 - place a hold on an item that is currently at branch A, for pickup at branch B
2 - check your item in at Branch A, click to confirm the hold and transfer (print slip if you want to)
3 - sudo koha-mysql kohadev: SELECT * FROM branchtransfers -- See one transfer
4 - check your item in at Branch A again, get a message that the item is supposed to go to Branch B. Don't click on the modal yet
5 - repeat 3 -- See two transfers, one cancelled as WrongTransfer, one pending
6 - Click 'Confirm and transfer' on the modal
7 - repeat 3 -- See three tranfers - the two from before and a new active transfer
8 - DELETE FROM branchtransfers
9 - Apply patch, restart all
10 - repeat 3 - no transfers
11 - Check item in at branch A again and confirm
12 - repeat 3, one transfer
13 - Check item in, don't confirm the modal
14 - repeat 3, one transfer
15 - Confirm the modal
16 - repeat 3, one transfer
17 - Check the item in at branch C
18 - repeat 3, two transfers - one cancelled WrongTransfer, one active
19 - Confirm modal
20 - repeat 3, two transfers
21 - Check item in at branch B
22 - repeat 3, two transfers, one cancelled, one completed
Signed-off-by: Christine Lee <chlee@pascolibraries.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
To test:
1 - Check out an old version of Koha and set some columns settings for holdings tables, or:
UPDATE columns_settings
SET columnname = CONCAT("holdings_",columnname)
WHERE module = 'catalogue' AND page='detail' AND tablename = "holdings_table";
UPDATE columns_settings
SET columnname = CONCAT("otherholdings_",columnname)
WHERE module = 'catalogue' AND page = 'detail' AND tablename = "otherholdings_table";
2 - perl -e 'use C4::Installer; my $result = C4::Installer::run_db_rev("/kohadevbox/koha/installer/data/mysql/db_revs/240600064.pl"); warn Data::Dumper::Dumper($result)'
3 - SELECT columnname FROM columns_settings WHERE module="catalogue" AND page="detail" AND ( tablename="holdings_table" OR tablename="otherholdings_table");
4 - Confirm column names are correct
5 - repeat 2
6 - Confirm column names are not affected on subsequent runs (items_group does not become group)
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
To test:
1. Set TransfersBlockCirc to 'Don't block'
2. Check in some items not from your library to initiate a transfer.
3. See the modal pop-op, "Transfer to home library"
4. However, you cannot continue to scan the next item unless you first dismiss the modal.
5. APPLY PATCH
6. Try again, this time at step 4 the barcode input should have focus and you'll be able to scan the next item.
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch adds desk_id reset functionality to the revert_found method,
but only for waiting holds where desk_id is actually relevant.
Changes:
* Modified revert_found() to conditionally reset desk_id
* Only resets desk_id for waiting holds (found=W)
* Leaves desk_id unchanged for in transit (T) and in processing (P) holds
* Added comprehensive test coverage for all scenarios
* Updated POD documentation to explain desk_id behavior
The logic is conservative and only clears desk_id when it makes sense:
waiting holds have their desk assignment cleared since they are no longer
waiting at a specific desk, while transit and processing holds remain
unchanged as they do not use desk_id.
To test:
1. Apply patch
2. Run tests:
$ ktd --shell
k$ cd /kohadevbox/koha
k$ prove t/db_dependent/Koha/Hold.t
=> SUCCESS: All tests pass including new desk_id handling tests
3. Verify all hold test suites still pass:
k$ prove t/db_dependent/Koha/Hold*.t
=> SUCCESS: All hold-related tests pass
4. Sign off :-D
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Test plan:
1) Perform an item inventory, be sure to have some items with problems
:) like 'wrong place'
2) On table if item has 'wrong place' problem (maybe others cases ?) if
it's linked to collection code just the AV code appears not the label
3) Apply this patch
4) Refresh page, normally that's okay now
Sponsored-by: BibLibre
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch makes updates to CSS and markup in order to fix the layout of
the enrollment period fields during the onboarding process.
To test, apply the patch and rebuild the staff interface CSS.
- Drop and recreate your Koha database.
- Restart all services
- Follow the web installer until you reach the onboarding stage "Create
a patron category."
- The enrollment period fields should look correct.
Sponsored-by: Athens County Public Libraries
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch corrects the template variable which populates the maxlenth
attribute on text fields in the add/edit item form.
To test, apply the patch and go Administratoin -> MARC bibliographic
frameworks -> (framework) -> Tag 952 -> Edit subfields.
- Click the "p" tab and set the "Max length" field to "20"
- Save the framework and go to Cataloging.
- Locate a bibliographic record that uses the framework you edited.
- Add or edit an item on that bibliographic record.
- Check the "Barcode" field. The input tag should limit your entry to 20
characters.
Sponsored-by: Athens County Public Libraries
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
To test:
1 - In the staff client do a search
2 - Select all results
3 - Add to list -> new list
4 - Scroll down, list name field is cut off
5 - Apply patch
6 - Close the list window and add to list again
7 - List name field is now visible
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch simply reduces our matching pattern to ensure the string is an exact match, rather than partial
To test:
- Create LOC authorized values of ADULT with description "Adult" and ADULTG with description "Adult - Grab and Go"
- Find a record with items and set one item to shelving location "Adult"
- Find a second record with items and set one item to shelving location "Adult - Grab and Go"
- Create an Item Search for Shelving location and select 'Adult' only
- Search and get one result from the record selected above
- Click Copy shareable link and paste/go in new tab
- See that the results now include both records from above
- Click Edit search button and notice that the Shelving location 'Adult - Grab and Go' was added to the selected criteria for the search
- Apply patch
- Repeat original search for 'Adult' location
- Click 'Copy shareable link'
- Open in new tab and confirm correct results
- Repeat with a search for 'Adult - Grab and Go' and confirm shareable link gets the correct results
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
We have reports of progressive slowdown on the circulation page during
long sessions. A likely cause might be a block in `circ/circulation.tt`
that attaches a new keypress handler to `#barcode` on every submit. Some
submits do not navigate (e.g. waiting holds modal, quick slip on empty
barcode), and pages restored from the bfcache keep previously attached
handlers. Over time, listeners accumulate and the UI becomes sluggish.
This patch installs a single, namespaced keypress handler at page load,
guarded by an in-flight flag toggled on submit. The handler shows the
“Barcode submitted” modal and prevents typing only while a submit is
in flight. The flag is reset on bfcache restores via `pageshow`. This
preserves existing UX while keeping the listener count constant.
Test plan:
1. Before applying the patch, open circ/circulation.pl for any patron.
2. In the browser console, run:
(function () {
const el = $('#barcode')[0];
const dataFn = jQuery._data || jQuery.data;
const ev = (dataFn && dataFn(el, 'events')) || {};
return (ev.keypress || []).length;
})()
Note the keypress handler count.
3. Enter a barcode and submit. Use the browser Back button to return.
4. Re-run the IIFE from step 2. The count has increased.
5. Repeat steps 3–4 a few times and observe the count continues to grow.
6. Apply the patch.
7. Reload the page and re-run step 2; count should be ~1.
8. Enter a barcode and submit. Use Back to return. Re-run step 2.
The count remains ~1 across submits and back/forward navigations.
9. Confirm UX is preserved:
- While submit is in flight, pressing keys in `#barcode` shows the
“Barcode submitted” modal and prevents typing.
- Waiting holds flow still shows its modal and behaves as before.
- Submitting with an empty barcode still triggers the quick slip
behavior per system preference and does not add handlers.
10. Optional: Simulate scanner behavior by pressing Enter rapidly after
submit. Verify the handler count remains stable.
Signed-off-by: krimsonkharne <philip.orr@posteo.de>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
To test:
1. Go to Administration > Additional Parameters > Identity providers
2. Click on +New identity provider
3. Notice that the "Add default OAuth configuration" and "Add default
OAuth mapping" buttons are not too visible. They just look like text
unless they are hovered on.
4. Apply the patch, restart all
5. Refresh the page and view the buttons again. The button visibility
has improved.
6. Sign off and have a nice day!
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Page suggestion/suggestion.pl calls CanUserUseBudget() in a loop,
will must use a uniq Koha::Patron object of the logged in user.
When there are many budgets and funds this takes some time.
Test plan :
Compare performance with and without patch with many budgets and funds
(see test plan of Bug 35921)
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This change fixes the Checkout status on moredetail.pl so that it
actually shows "Not checked out" when it's not checked out.
Test plan:
0. Apply the patch
1. Go to /cgi-bin/koha/catalogue/moredetail.pl?biblionumber=29 on a fresh KTD
2. Note that the "Checkout status" is "Not checked out"
3. Check out the item to someone
4. Go to /cgi-bin/koha/catalogue/moredetail.pl?biblionumber=29
5. Note that it says "Checked out to <person> Due back on <date>"
6. Renew the item
7. Go to /cgi-bin/koha/catalogue/moredetail.pl?biblionumber=29
8. Note that it says "Checked out to <person> Last renewed <date>, Due back on <date>"
Signed-off-by: Anneli Österman <anneli.osterman@koha-suomi.fi>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch added the option to update borrowers.lastseen when a patron username
and password is verified via the REST API. This can be enabled or disabled
selectively using the TrackLastPatronActivityTriggers system preference
using the [ ] Patron authentication via API option..
To test:
1. Create a new user, ensuring to set the Username and password fields.
*Import to do this first*
2. Edit the TrackLastPatronActivityTriggers syspref and check all options.
3. Ensure the RESTBasicAuth syspref is set to Enable.
4. Check the lastseen date of your new user using a SQL report
SELECT borrowernumber, userid, lastseen FROM borrowers WHERE userid = 'USERNAME'
(Replace USERNAME with your chosen username for the new patron)
NOTE: **Ensure the cache expiry of the SQL report is set to 0**
5. The lastseen for your new user should be null
6. 'restart_all' Koha services to clear plack cache.
7. Run the attached api_verify_lastseen.pl test script
**Change P_USERNAME and P_PASSWORD to the username and password of your new user.
(script contains expected output for successful verification)
8. Re-check the lastseen date of your new user again via SQL (step 4)
The lastseen should still be null.
9. Apply Patch
10. 'restart_all' Koha services
11. Edit the TrackLastPatronActivityTriggers syspref and check the '[ ] Patron authentication via API' option
12. Rerun the api_verify_lastseen.pl
13. Re-check the lastseen date of your new user again via SQL (step 4)
The lastseen should now be updated to the time of the last script run.
For good measure:
14. Edit the TrackLastPatronActivityTriggers syspref and **UNcheck** the '[ ] Patron authentication via API' option
15. 'restart_all' Koha services to clear plack cache.
16. Rerun the api_verify_lastseen.pl
17. Re-check the lastseen date of your new user again via SQL (step 4)
The lastseen should have remained the same as previous.
Sponsored-by: Westlake Porter Public Library <https://westlakelibrary.org>
Signed-off-by: Bernard Scaife <bernard.scaife@openfifth.co.uk>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch introduces tests for the feature enabling patron's `lastseen`
attribute be updated when a successful password validation happens
through the API.
To test:
1. Apply this patch
2. Run:
$ ktd --shell
k$ prove t/db_dependent/api/v1/password_validation.t
=> FAIL: Tests fail! The feature is not implemented!
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: David Flater <flaterdavid@gmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
On the licenses page, there are some occurrences of "licence"
(British English spelling). License (US American spelling)
should be used.
Test plan:
1. Go to More > About Koha > Licenses.
2. Search the page for "licence".
3. Note some occurrences of "licence", which is the British English
spelling.
4. Apply the patch and refresh the page.
5. Repeat step 2.
6. Note that there are now no occurences of "licence".
7. Sign off.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
To test:
-Same test plan as with "Book drop mode" but for "Forgive overdue charges"
Signed-off-by: CJ Lynce <cj.lynce@westlakelibrary.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
To test:
1. Put an item in transfer to a different library than the logged in branch
2. Go to Circulation > Check in
3. Choose the "Book drop mode" option and check in a few items NOT from step 1.
4. See the "Book drop mode" choice is remembered after every selection.
5. Check in the item from step 1 to make a wrong transfer
6. The modal pops up for wrong transfer, click confirm
7. Now the choice of "Book drop mode" is forgotten.
8. APPLY PATCH
9. Try again, this time the "Book drop mode" selction should be retained
Signed-off-by: CJ Lynce <cj.lynce@westlakelibrary.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Test plan, k-t-d, don't apply patch yet:
1) Install a plugin that sends the cookie to output_html e.g.:
https://github.com/openfifth/koha-ill-libkey-lending-tool/releases/tag/v2.3.8
2) Log out. Access this plugin's tool link directly:
<staff_url>/cgi-bin/koha/plugins/run.pl?class=Koha%3A%3APlugin%3A%3ACom%3A%3APTFSEurope%3A%3AIncDocs&method=tool
3) Notice you're presented the login screen. Login using koha:koha
4) Notice you're shown the plugin's respective tool page. It looks like you're authenticated but you're not. Click on any of the top links e.g. 'Circulation' or 'Patrons'.
5) Notice you're shown the login page again.
6) Apply patch. Repeat. Step 5 should no longer show the login page but instead the page you clicked on.
Signed-off-by: Tomas Jiglind <tomas.jiglind@mariestad.se>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
To test:
1. Set the 'item-level_itypes' system preference to 'Bibliographic record'
2. Go to any record that contains items and look at the holdings table.
3. Click 'Show filters'.
4. Notice that the Status column doesn't appear to have a filter.
5. APPLY PATCH
6. Try again, the Status filter should appear correctly. Make sure all other filters appear correct.
7. Set 'item-level_itypes' back to 'specific item'.
8. Make sure the filter still appears correctly. Make sure all other filters appear correct.
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
See also comment33, point 4.
Test plan:
cp debian/templates/apache-shared-opac-antibot.conf /etc/koha/
Test enabling/disabling by toggling the comment of the SetEnvIf line,
restart apache and remove the KOHA_INIT and CGISESSID cookie.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch adds a fast simple bot challenge via Apache.
To test:
0. Apply the patch
1. sudo cp debian/templates/apache-shared-opac-antibot.conf /etc/koha/.
2. sudo cp debian/templates/apache-shared-opac-plack.conf /etc/koha/.
3. curl http://localhost:8080/cgi-bin/koha/opac-search.pl
4. Note an instant response with a very simple HTML response
5. Open an incognito browser and go to http://localhost:8080/cgi-bin/koha/opac-search.pl
6. Note a very brief loading animation before the OPAC search page appearing
7. Do a search
8. Note no more loading animation appears
9. Close the incognito browser
10. Open an incognito browser and go to http://localhost:8080/cgi-bin/koha/opac-main.pl
11. Do a search via the "Library catalog" search bar
12. Note no loading animation appears
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Cornelius Hertfelder <cornelius.hertfelder@bsz-bw.de>
Signed-off-by: Magnus Enger <magnus@libriotech.no>
We have tested this in production on at least three live sites for
several weeks, and it has worked as expected. We have not noticed any
negative side effects.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch addresses CSV formula injection vulnerabilities by ensuring
all Text::CSV instances use formula protection.
Changes made:
* Add formula => 'empty' to all Text::CSV constructors in:
- Koha::Patrons::Import
- Koha::BackgroundJob::ImportKBARTFile
- Koha::ERM::EUsage::CounterFile
The 'empty' formula mode causes potentially dangerous formulas (starting
with =, +, -, @) to be treated as empty strings rather than executed,
preventing CSV injection attacks while maintaining data integrity.
Security impact:
* Prevents execution of malicious formulas in CSV imports
* Protects against data exfiltration via CSV formula injection
* Maintains backward compatibility for legitimate CSV data
To test:
1. Apply the previous patch (author test)
2. Run:
$ ktd --shell
k$ prove xt/author/Text_CSV_Various.t
=> FAIL: Should show 3 files without formula protection
3. Apply this patch
4. Repeat 2
=> SUCCESS: All tests should now pass
5. Try importing CSV with formula content (=cmd|"/c calc",test,data)
=> SUCCESS: Formula content is rejected/emptied, not executed
6. Import normal CSV data
=> SUCCESS: Normal data imports correctly
7. Sign off :-D
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This test ensures all Text::CSV usage in Koha includes proper formula
injection protection to prevent CSV formula injection attacks.
The test scans all Perl modules and verifies that Text::CSV constructors
include the 'formula' parameter set to a safe mode ('empty', 'die',
'croak', 'diag', or numeric 1-5).
To test:
1. Apply this patch
2. Run:
$ ktd --shell
k$ prove xt/author/Text_CSV_Various.t
=> FAIL: Test should fail showing files without formula protection:
- Koha/Patrons/Import.pm
- Koha/BackgroundJob/ImportKBARTFile.pm
- Koha/ERM/EUsage/CounterFile.pm
3. Apply the follow-up patch to fix the violations
4. Repeat 2
=> SUCCESS: All tests should pass
5. Sign off :-D
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch adds a relator term that was added to the MARC code list for
relators in the June 4, 2025 technical notice. The new term is waw -
Writer of afterword.
To test:
1. Apply patch and reset_all
2. Go to Administration > Authorized values
3. Search for the RELTERMS list and click on it
4. Search for waw
--> There should be an entry for waw - Writer of afterword
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch adds a relator term that was added to the MARC code list for
relators in the April 3, 2025 technical notice. The new term is wfw -
Writer of foreword. This technical notice also deprecates an existing
term, aui (author of introduction), in favour of the new term.
To test:
1. Apply patch and reset_all
2. Go to Administration > Authorized values
3. Search for the RELTERMS list and click on it
4. Search for wfw
--> There should be an entry for wfw - Writer of foreword
5. Search for aui
--> Term should not exist
Note : This update includes a term deprecation. I decided to go ahead
and remove it from the authorized values list because, unlike for MARC
frameworks, a nonexistent value will not delete data from the records.
It will simply say "aui (Not an authorized value)". Furthermore, this
only affects new installations. Nothing will be deleted from existing
installations, unless the libraries themselves remove the authorized
value. They can make a batch modification before deleting it if
necessary.
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This patch adds new relator terms that were added to the MARC code list
for relators in the Februrary 2, 2025 technical notice. The new terms
are ink - Inker, and pnc - Penciller.
To test:
1. Apply patch and reset_all
2. Go to Administration > Authorized values
3. Search for the RELTERMS list and click on it
4. Search for ink
--> There should be an entry for ink - Inker
5. Search for pnc
--> There should be an entry for pnc - Penciller
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Martin Renvoize
Matthias Le Gac
emilyrose
Lucas Gass
David Cook
Pedro Amorim
Aleisha Amohia
Nick Clemens
Tomas Cohen Arazi
Thibaud Guillot
Owen Leonard
Paul Derscheid
Laura_Escamilla
Fridolin Somers
CJ Lynce
Baptiste Wojtkowski
David Nind
Marcel de Rooy
Jonathan Druart
Caroline Cyr La Rose