Also, it is recommended to apply bug 17103 before this.
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Oliver Bock <oliver.bock@aei.mpg.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit c0ac389c1e)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
When running Koha in a full-site-SSL configuration accessing
external resouces like Open Library cover images via HTTP
doesn't work (mixed SSL/non-SSL content). It thus breaks a
core feature of Koha. Referencing such resources always via
HTTPS resolves the problem and also enhances privacy as a
side-effect.
Previous tickets took care of Amazon resources. This ticket
is supposed to address the remaining external resource providers,
starting with Open Library.
TEST PLAN
---------
1) Over https access your OPAC with the Enhanced Content system
preferences 'OpenLibraryCovers' set to 'Add', and
'OpenLibrarySearch' set to 'Show'.
2) Search for something (e.g. Mo Willems)
-- Your browser console log will show messages about
mixed content.
3) Apply the patch
4) Making sure to reload the java script, attempt steps 1 & 2
again.
-- no mixed content messages should be given
5) run koha qa test tools
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 40b9645bf6)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
No idea how to replicate this issue but we have been getting several reports
about the following error:
Software error:
Corrupted storable string (binary v2.9) at /usr/lib/perl/5.18/Storable.pm line
417, at /home/koha/kohaclone/cataloguing/additem.pl line 375.
TEST PLAN:
1. Add or modify an Item.
2. No observed changes.
?. We don't know what causes this but we know that add/modify Item occasionally
crashes due to failure of a cookie thawing.
This patch prevents the whole program from dying, because this error is not
critical enough to warrant dying.
Also there is no centralized mechanism in Koha for showing messages to the
user, so there is no easy and convenient way to warn the user that the:
'LastCreatedItem'-cookie or the systempreference 'PrefillItem' is
malfunctioning.
So we instead just warn to the server logs with the malfunctioning cookie in
hopes of nailing down what causes the issues.
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 9237fe6763)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
This patch replaces the hardcoded protocol ("http") from the URI with
https since that is what Google defacto uses to serve JS resources
Prevents MIXED CONTENT failure, allowing GoogleIndicTransliteration
to function correctly when used in SSLized OPACs.
Test plan
---------
1/ Make sure your OPAC is being served both over HTTP and HTTPS
2/ Set GoogleIndicTransliteration syspref to "Show"
3/ Access the OPAC over http, Google transliteration element will
show up in masthead searchbox.
4/ Access the OPAC over https. The element will not show. Console
will show MIXED CONTENT error and failure of google loader.
5/ Apply patch. Repeat steps #3 and #4 again. Now in both cases
GoogleIndicTransliteration will work.
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 6fcd32a75c)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
This patch adds a function to the koha-plack script so it checks for log file
existence and its permissions. This function is called from the start_plack function.
If some of this conditions are not fulfilled, it solves the situation by either
touching and/or changing the permissions accordingly for the instances' plack log files.
To test:
- Run (on kohadevbox):
$ cd kohaclone
$ debian/scripts/koha-plack --start kohadev
$ debian/scripts/koha-plack --stop kohadev
$ ls /var/log/koha/kohadev/plack*
- Verify ownership of the created files (they might belong to the root user)
- Apply the patch
- Run:
$ chown root:root /var/log/koha/kohadev/plack*
$ debian/scripts/koha-plack --start kohadev
$ ls /var/log/koha/kohadev/plack*
=> SUCCESS: Files belong to kohadev-koha:kohadev-koha
- Run:
$ debian/scripts/koha-plack --stop kohadev
$ rm /var/log/koha/kohadev/plack*
$ debian/scripts/koha-plack --start kohadev
$ ls /var/log/koha/kohadev/plack*
=> SUCCESS: Files are created and belong to kohadev-koha:kohadev-koha
- Sign off :-D
Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 007d2feee6)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
This patch follows Galen's suggestion in comment #7.
TEST PLAN
---------
1) Back up your koha logs as desired.
2) add something to /var/log/koha/{instance name}/intranet-error.log
3) ps aux | grep zebra
4) logrotate -f /etc/logrotate.d/koha-common
5) ps aux | grep zebra
-- the zebrasrv and daemon process for zebra indexing
didn't restart.
6) apply this patch against /usr/sbin/koha-stop-zebra
7) sudo koha-start-zebra {instance name}
8) ps aux | grep zebra
-- the processes should have started up again.
9) add different junk to /var/log/koha/{instance name}/intranet-error.log
10) ps aux | grep zebra
11) logrotate -f /etc/logrotate.d/koha-common
12) ps aux | grep zebra
-- the process ids for the zebrasrv and daemon processes should
be different, but the number of processes is the same as before.
13) sign off, because its less ugly than comment #3
Sponsored-by: Tulong Aklatan
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Works as expected, no regressions found.
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit ac4a058b05)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
When edit or create a new vendor the two fields "email" and "website" don't test
if the data provided is right. When you add a direction like
"koha-community.org" without the protocol "https" the program redirect to an
404 error.
To reproduce the issue:
1-Go to Acquisition and create a new Vendor
2-Fill the field Website with koha-community.org
3-Use an email without at sing (@)
4-Notice that there is no error
5-Save
6-Go to the vendor created (/cgi-bin/koha/acqui/supplier.pl?booksellerid=1)
7-Click in Website: koha-community.org -> redirect to an 404 error
8-Notice the bad mailto:
To test:
-Apply patch
-Reproduce step 1 to 8 with the same vendor or create a new one
-Enter multiple wrong and valid urls
-Enter urls with and without protocols http, https, ftp
-Enter wrong and valid emails
NOTE: The classes used are taken from 'branches.tt'
Signed-off-by: Liz Rea <liz@catalyst.net.nz>
no longer allows entering of improper website urls or incomplete email addresses.
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 71d20a8c3b)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
The breadcrumb on the Acquisition's home page reads: Home > Acquisitions >
This tiny patch removes the trailing > (›)
Amended: Remove the link on 'Acquisitions' as well...
Signed-off-by: Claire Gravely <c.gravely@arts.ac.uk>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 865557e05c)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Fix capitalization for "Report Plugins" in reports-home.tt according with
Coding Guidelines <https://wiki.koha-community.org/wiki/Coding_Guidelines#HTML4:_Upper_and_lower_cases_in_strings>
Signed-off-by: Marc <veron@veron.ch>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 67a65ba16f)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
In Staff client, the advanced serach form does not display the
translations of item types.
(Note: It is not necessary to have translations installed to verify
this bug.)
Prerequisites:
- Go to Home > Administration > Item types administration
- Edit e.g. item type "BK" (Book)
- Near "Description", click link "Translate into other languages
- If you have other languaes installed, add translatons for those
- If you have an Englis only installation, add a "translation" for
English, make sure that you can identify it while testing (I
used "BOOOOOOOOOOOOKS")
Verify:
- Go to Home › Advanced search
- Verify near "Limit to any of the following" that the description for
itemtype BK reads "Book" instead of "BOOOOOOOOOOOOKS"
Test:
- Apply patch
- Verify that the item type description now reads ""BOOOOOOOOOOOOKS"
- If you have a multi language installaton, verify that item types
you translated display as appropriate
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 4a691fda16)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
The patron category description is not passed to the template in
paycollect.pl
Note: The Categories TT plugin should be used here...
Test plan:
Go on paycollect.pl and confirm that the patron category description is
now displayed in the sidebar.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Brendon Ford <brendon.ford@manhattan.edu>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit c3badb0c57)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Returned items may have 3 kinds of notes, patron, item public, and item
non-public. However, the html markup for them does not allow us to
distinguish which type we are seeing. It would be good to add classes
for each of these note types.
Test Plan:
1) Check out an item to a patron
2) Add a patron note, a public item note, and a non-public item note
to the patron and item you used
3) Check in the item and instead the html, note the each note span
now has a class to distinguish which type of note is being displayed.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit dbfda36767)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
To verify:
- Log in to OPAC as a user who has fines or credits
- Go to page "your fines"
- Verify that values for "Fine amount", "Amount outstanding"
and "Total due" are not formatted as defined in syspref CurrencyFormat
(e.g. for FR)
To test:
- Apply patch
- Repeat steps above
- Verify that values are formatted as appropriate with different
settings for syspref CurrencyFormat
Note: This patch does not force text alignment to the right.
Text alignement can be done using syspref OPACUserCSS
(td.sum, td.credit, td.debit)
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit d76737ba7d)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Format the values in patron search results following syspref CurrencyFormat.
To verify:
- Search for patrons who have fines or credits
- In result table, column 'Fines' does not respect syspref CurrencyFormat
(e.g. for FR)
To test:
- Apply patch
- Repeat steps above, verify that fines display as appropriate
- Change syspref Currencyformat, verify display
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 6359922847)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Numeric comparison operator is used where string comparison required,
resulting in the following warning in the log: 'Argument "delete" isn't
numeric in numeric eq (==).'
This patch corrects it to use 'eq' not '==' to compare strings.
To test, apply the patch and go to Acquisitions -> EDIFACT messages.
Delete an EDIFACT message. There should be no error in the error log.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit cc6fc0800c)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
To test
1/ Hit the page, notice the warning in the log
2/ Apply patch
3/ Hit page, notice no warning in the log
4/ Test functionality all still works
Works as expected. (Note: See Bug 16960 for updating patron details).
Signed-off-by: Marc <veron@veron.ch>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 0ef3b19dbd)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Test plan:
update and install translated language files
On the item list (cataloguing/additem.pl) the context menu should be
translated (Edit item/Delete item)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 72150ee759)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Indeed, it's not used!
Test plan:
git grep '\[% findborrower'
should not return any result.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 5995bd77a6)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Bug 10318 added the email to the patron search results but it has been
removed later.
This patch reintroduced it where it was (no new column).
Test plan:
Search for patrons and confirm that the emails are displayed.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 034f939a44)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
To test:
- for a particular item type & patron category, configure a non-zero
"no renewal before" date so items can't be immediately renewed
- sign in as a patron in aforementioned patron category
- check out an item of aforementioned item type
- go to your renewals page in OPAC /cgi-bin/koha/opac-user.pl
- an error messages appears in the div.alert.dialog up top
Sponsored-by: California College of the Arts
Signed-off-by: Brendon Ford <brendon.ford@manhattan.edu>
Signed-off-by: Irma Birchall <irma@calyx.net.au>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit aa2f56fa1a)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
If language is set by external link language switcher does not work
To reproduce:
- Have a multilingual koha installation, let's say en, de-CH, fr-FR and it-IT
- Create external links e.g. from your multilingual library website to each language variant of OPAC:
...cgi-bin/koha/opac-main.pl?language=en
...cgi-bin/koha/opac-main.pl?language=de-CH
...cgi-bin/koha/opac-main.pl?language=fr-FR
...cgi-bin/koha/opac-main.pl?language=it-IT
Each link opens fine displaying the language as appropriate.
Now try to switch language on the page you just opened via the external link.
It won't work, it will always stay on the language defined by the external link.
To test:
- Apply patch
- Repeat steps above
- Verify that the language switcher works
- Verify in browser address field that after switching language, the param 'language= 'has vanished from url string
- Try links with multiple params and with params containing 'language', e.g.
...cgi-bin/koha/opac-search.pl?language=fr-FR&q=language&mylanguage=test
- Verify that only the parameter 'language=' vanishes
Tested counter patch, works as well.
Signed-off-by: Marc <veron@veron.ch>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 62d16aa6b7)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
This patch fixes sentences splitting in file
koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt
Fix is done with a new .inc file because the code is the same as in
koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
To test:
- Carefully review code changes
- Test on a fresh install without example data (or save database
and test with empty tables 'branches' and 'categories')
- Go to Home > Patrons (members-home.pl)
- Verify that a warnings appears aubout missing libraries and patron
categories
- Try to add a new patron (memberentry.pl)
- Verify that the same messages are triggered
- Verify that messages disappear as appropriate as soon as a library and
a patron category are defined.
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Note: Filed Bug 17093 for JS error on patron entry form.
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 5dd9a2546a)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
From Koha::DateUtils::output_pref:
$dt = eval { dt_from_string( $str ) } if $str;
carp "Invalid date '$str' passed to output_pref\n" if $@;
This second line is wrong: if $str does not exist, the first line is not evaluated and $@ could be filled with previous error.
To reproduce:
Then:
prove t/DateUtils.t
will display:
t/DateUtils.t .. 20/60 Use of uninitialized value $str in concatenation (.) or string at Koha/DateUtils.pm line 217.
Invalid date '' passed to output_pref
at t/DateUtils.t line 233.
t/DateUtils.t .. ok
All tests successful.
Files=1, Tests=60, 2 wallclock secs ( 0.02 usr 0.00 sys + 1.40 cusr 0.00 csys = 1.42 CPU)
Result: PASS
Test plan:
Without this patch, you should not see the carp
Signed-off-by: Srdjan <srdjan@catalyst.net.nz>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit c31213ba4f)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
If there was more than one search term you could see that that it
was url encoded. Also problems with search terms with umlauts and
other diacritics.
Patch should fix that.
https://bugs.koha-community.org/show_bug.cgi?id=17074
Signed-off-by: Marc <veron@veron.ch>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 09d7a47f1f)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
The 'scan indexes' search that can be reached from the
advanced search has 2 problems to begin with:
- The search term you searched for is not displayed
in the input field.
- The links in the result list are missing the index
and because of that, are not giving the correct results.
To test:
- Go to the advanced search, select an index to search in
- Enter a search term and check 'scan indexes'
- Submit search
- Check if the search term is visible in the input box
- Check if the result links contain your selected index
and give you correct results (count and the number of
results should match)
Tested both patches together, works as expected.
Signed-off-by: Marc <veron@veron.ch>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 8d7e62b808)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
If you click the clear button to clear the search term it does take the search
term away. However, the next time you click on "Saved reports" the search term
is still there.
TO TEST:
1. Reports > Use saved
2. Filter on anything (date/author/keyword). Let say "foo" in keyword.
3. Click the Clear link on the Filter form. You can see that "foo" is removed
from keyword, and all the saved reports are displayed.
4. Click "Saved Reports" on the left. You can see that "foo" reappears in
keyword filter.
5. Apply the patch, and repeat steps 2-4.
Signed-off-by: Jesse Maseto <jesse@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit aa0e27ea08)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
This was set to a version that is not available in Wheezy or Jessie.
The version is not required, the only change to 1.42 (packaged for
Wheezy and Jessie) is a fix for Windows, see
http://cpansearch.perl.org/src/PETDANCE/Test-WWW-Mechanize-1.44/Changes
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 893f6cc263)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
The more correct solution is fix that template file.
However, in the mean time, this works.
TEST PLAN
---------
1) find a record
2) edit record
3) click value builder for 007
4) change everything to pipes as much as possible.
(use Motion Picture to get all 00-22 values)
5) save
-- should save just fine.
6) click the value builder again
-- OOPS! Bad reload.
7) prove t/db_dependent/FrameworkPlugin.t
-- NOISY 007 messages.
8) apply patch
9) click the value builder again
-- good reload
10) prove t/db_dependent/FrameworkPlugin.t
-- No noise related to 007.
11) run koha qa test tools.
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 22c851cc2f)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Test plan:
Search for something like:
\";alert(1)//135
=> Without this patch you will see the alert
=> With this patch, no more alert
Note that this fix the parameters idx, q and op
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit b543fa74fe)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Test plan:
Enter the following in the "Check out" tab:
"><script>alert('XSS')</script>
=> Without this patch you will see the alert
=> With this patch, no more alert
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 96a9c2715e)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Test plan:
Enter the following in the barcode input:
<script>alert('XSS')</script>
=> Without this patch you will see the alert
=> With this patch, no more alert
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 12b4c83f5a)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Test plan:
Hit
/serials/serials-search.pl?ISSN_filter="%2F><script>alert('XSS')<%2Fscript>&searched=1
/serials/serials-search.pl?title_filter="%2F><script>alert('XSS')<%2Fscript>&searched=1
=> Without this patch you will see the alert
=> With this patch, no more alert
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 1ea1504c30)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Hit
/cgi-bin/koha/catalogue/detail.pl?biblionumber=1<script type="text/javascript">alert("XSS")</script>
/cgi-bin/koha/catalogue/ISBDdetail.pl?biblionumber=1<script type="text/javascript">alert("XSS")</script>
/cgi-bin/koha/catalogue/MARCdetail.pl?biblionumber=1<script type="text/javascript">alert("XSS")</script>
/cgi-bin/koha/catalogue/moredetail.pl?biblionumber=1<script type="text/javascript">alert("XSS")</script>
/cgi-bin/koha/catalogue/labeledMARCdetail.pl?biblionumber=1<script type="text/javascript">alert("XSS")</script>
=> Without this patch you will see the alert
=> With this patch, no more alert
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit f3a8e5a411)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Adds a note about missing support for NORMARC (only supports
MARC21 and UNIMARC) to the system preference text.
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 821cb91a80)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Playing with OPACResultsLibrary syspref, biblio with items having different
home/holding library are displayed properly.
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 492d79a7df)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
When you search in the OPAC it shows you the HOME branch on the location
in XSLT, but if you click through to the detail page it shows you the
CURRENT BRANCH in the holdings table which is very confusing to patrons.
I don't know what's the right solution - home or holding branch, but they
should be the same in both places for the patron's sake. If you do the same
search in the staff client you see the right branch info on the search results
and on the detail page.
Test Plan:
1) Apply this patch
2) Run updatedatabase.pl
3) Search the catalog, you search should include results with items
that have different home and holding libraries.
4) The results should look the same as before the patch
5) Change the system preference OPACResultsLibrary to "current location"
6) Refresh your page of search results
7) The results show now show the holding library instead of the home library
Signed-off-by: Barbara Walters <bwalters@ncrl.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 4db2e745e2)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Removes commented line from bib1.att.
Adjust OCLC-number to Other-control-number in comment of ccl properties.
No need to explicitly add 035$a and $z if you index 035 completely in
record.abs as well as biblio-koha-indexdefs.xml.
Rerun koha-indexdefs-to-zebra.xsl on index defs.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 5b4259be9c)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
1) Apply patch
2) Make sure that you have a bib that has MARC21 035$a (and possibly also 035$z) populated.
pre 3) Replace all modified zebra files and restart zebra server
3) Rebuild zebra: misc/migration_tools/rebuild_zebra.pl -x -b -z
4) Add the following to the intranetuserjs syspref:
$(document).ready(function(){
// Add Other Control Number to advanced search
if (window.location.href.indexOf("catalogue/search.pl") > -1) {
$(".advsearch").append('<option value="Other-control-number">Other Control Number</option>');
}
});
5) Do an advanced search, select "Other Control Number" from the search menu, then add the Other Control Number in 035$a for the bib specified in step 1.
Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Works, no koha-qa errors
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 84f51549c9)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
This makes debian/list-deps ready for Debian Jessie
and adds small fixes I already use for package releases.
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
This has not been updated for a while. I plan to add the stable
releases.
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 8102098fa6)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
This patch is the starting point for making the REST api available
on Plack.
What it does:
- It creates the /api/v1/app.pl mount point in plack.psgi
- It enables the ProxyPass and ProxyPassReverse directives so it
is reached through Plack.
- It sets rewrite rules so we can use the 'pretty' urls (i.e.
/api/v1/patrons instead of /api/v1/app.pl/api/v1/patrons).
To test:
- Grab the following files, and put them in /etc/koha (overwrite the existing ones)
debian/templates/apache-shared-intranet-plack.conf
debian/templates/apache-shared-opac-plack.conf
- Tweak your /etc/koha/sites/kohadev/plack.psgi file so the API-related stuff
is present on your file.
- Make sure Plack is enabled for the instance:
$ sudo koha-plack --enable kohadev
$ sudo koha-plack --restart kohadev
$ sudo service apache2 restart
- Follow the previous patch test plan, but use this URLs (no pretty URL):
http://localhost:8080/api/v1/app.pl/api/v1/patrons/50http://localhost:8081/api/v1/app.pl/api/v1/patrons/50
=> SUCCESS: You get a JSON response from the API [1]
- Not use this URLs:
http://localhost:8080/api/v1/patrons/50http://localhost:8081/api/v1/patrons/50
=> SUCCESS: You get a JSON response from the API [1]
- Sign off :-D
[1] this patch made a bug visible (the session is lost when accessing the API through
Plack) but it shouldn't prevent its inclusion because the API right now is not even available
as default for developers to test or fix it.
Signed-off-by: Benjamin Rokseth <benjamin.rokseth@kul.oslo.kommune.no>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit e4bb70a447)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
This patch enables access to the REST API endpoint on packages setup.
It does so, by patching the shared apache-shared-intranet.conf and
apache-shared-opac.conf.
You can build your own master packages with this patch applied, or just:
- Grab
debian/templates/apache-shared-intranet.conf
debian/templates/apache-shared-opac.conf
and overwrite their counterparts in /etc/koha on a packages setup. For example
in kohadevbox.
- Have Koha loaded with all default data
- Create a superlibrarian user for you
- Login to the intranet and the OPAC
- Point your browser to:
http://localhost:8080/api/v1/patrons/51
=> SUCCESS: You get JSON data, for the patron you requested
http://localhost:8081/api/v1/patrons/51
=> SUCCESS: You get JSON data, for the patron you requested
- Sign off :-D
Note: I use the HTTPRequester addon for Firefox, re-using the CGISESSID value from the
browser session cookie, in the headers.
Signed-off-by: Benjamin Rokseth <benjamin.rokseth@kul.oslo.kommune.no>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 6e38b8b60f)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
C4/Auth_cas_servers.yaml.orig gets cleaned away after every package build because
of the .orig extension. This patch moves it.
It is only a sample file, there is no functionality to test. Just verify that the
file is there with the new name after you applied the patch.
Signed-off-by: Claire Gravely <c.gravely@arts.ac.uk>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 30474a3215)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
This .sql~ backup file should not have been committed.
Signed-off-by: Claire Gravely <c.gravely@arts.ac.uk>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 3964fac311)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
This adds a basetgz parameter to specify a pbuilder image.
I use this to build against different distributions.
This also updates the version number for master builds to 16.06.
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit bbaaabd1da)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
empty HTML list item on 'holds' page, to test:
- sign in as user
- attempt to place hold
- view source in between 'holds note' textarea & <!-- ITEM HOLDS --> comment
- note empty <li>
- apply patch
- repeat process above up until patch
- no more empty <li>
Signed-off-by: Jason Robb <jrobb@sekls.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
(cherry picked from commit 17a5ef5119)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
With this patch all sample/defintions .sql files are updated and translated into Italian
(if you select italian during web installation).
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
(cherry picked from commit d0f2bad12e)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Mark Tompsett
Oliver Bock
Olli-Antti Kivilahti
Indranil Das Gupta (L2C2 Technologies)
Tomas Cohen Arazi
Hector Castro
Marc
Jonathan Druart
Kyle M Hall
Colin Campbell
Chris Cormack
phette23
Katrin Fischer
Frédéric Demians
Mirko Tietgen
Marcel de Rooy
Barton Chittenden
Tomas Cohen Arazi
Zeno Tajoli