The purpose of no block checkouts in SIP is to indicate that the SIP machine has made an offline ( "store and forward" ) transaction.
The patron already has the item. As such, the item must be checked out to the patron or the library risks losing the item do to lack of tracking.
As such, no block checkouts should not be blocked under any circumstances.
The sub C4::SIP::ILS::Transaction::Checkout::do_checkout already honors this, but it is wrapped by
C4::SIP::ILS::checkout which has additional checks that do not.
Test Plan:
1) Apply the unit test patch
2) prove t/db_dependent/SIP/Transaction.t will fail
3) Apply the second patch
4) prove t/db_dependent/SIP/Transaction.t will pass!
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit 56d2ccc3f7)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This change makes $sessionID consistently return using the session
ID and not sometimes the session object.
Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. curl -v 'http://localhost:8081/cgi-bin/koha/svc/authentication' --cookie-jar /tmp/test.cookies
3. Note the Csrf-Token header value
4. Replace the <CSRF-TOKEN>, <USERID>, and <PASSWORD> tokens in the next step
using the appropriate values (eg the CSRF-TOKEN is from the previous step)
5. curl -v -H "Content-Type: application/x-www-form-urlencoded" \
-H "Csrf-Token: <CSRF-TOKEN>" -XPOST \
'http://localhost:8081/cgi-bin/koha/svc/authentication' \
-d "login_userid=<USERID>&login_password=<PASSWORD>" \
--cookie /tmp/test.cookies --cookie-jar /tmp/test.cookies
6. curl -XGET -v 'http://localhost:8081/cgi-bin/koha/svc/bib/29' \
--cookie /tmp/test.cookies > rec.marcxml
7. curl -v 'http://localhost:8081/cgi-bin/koha/svc/authentication' \
--cookie /tmp/test.cookies --cookie-jar /tmp/test.cookies
8. Note the Csrf-Token header value
9. curl -H "Content-Type: text/xml" -H "Csrf-Token: <CSRF-TOKEN>" \
-XPOST -v 'http://localhost:8081/cgi-bin/koha/svc/bib/29' \
--cookie /tmp/test.cookies --data @rec.marcxml
Signed-off-by: Jan Kissig <bibliothek@th-wildau.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 04dbbcc2f2)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit b20741c4eb)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
C4::Context->multivalue_preference is not used so far and split on |
However the values of "multiple" sysprefs are separated by... comma!
Let support both here.
This patch also removes silly JS code in the template.
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit 7b0f6f6bc1)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This change invokes Template::Filters->use_rfc3986 in the C4::Template
module.
Test plan:
0. Apply the patch
1. Note that "uri" and "url" filters now escape single quotes
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit 75e05bdd60)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Combining three regexes into one. Typo replcing.
Adding a test with pipe in pwd.
Test plan:
Run t/SIP/Sip.t
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit 34c0bd2c51)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Koha's SIP2 server does a lot of logging, including all incoming
requests, in full. This means that passwords are logged, both for
the user the SIP2 client uses for logging into Koha, as well as
for the end users who provide a password to e.g. check something
out. This patch replaces passwords with three asterisks in
log strings, before they are written to the log.
To test, in ktd:
- Run the new tests:
$ prove t/db_dependent/SIP/Sip.t
- Tail the SIP2 logs:
$ sudo tail -f /var/log/koha/kohadev/sip*.log
- Telnet into the SIP2 server:
$ telnet localhost 6001
- Try logging in by pasting this into the telnet session:
"9300CNterm1|COmypassword|CPCPL|"
- Verify that "mypassword" is replaced by "***" in the logs
- Try different values for the password, including the correct password
which is "term1" in ktd
- Try other SIP2 messages that include password fields (AC, AD, CO)
Update 2024-12-03: Fix issues pointed out by QA.
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Alex Buckley <alexbuckley@catalyst.net.nz>
(cherry picked from commit cb20df02a8)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Magnus Enger <magnus@libriotech.no>
The new test fails without this patch, and passes
when it is applied.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 580fa86f25)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
The original implementation of fine items was accidently overwritten with this patch. This follow up reverts these changes but keeps additional improvements that were also part of this patch.
These are:
- Returning the active currency as part of the response (BH)
- Fixing the number of items in the response which are specified in BP and BQ when other items as fine items are requested.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit e5bd8aec41)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 2685372f23)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch adds fine items (AV) to patron information response in SIP2
In addition the active currency we be part of the response (BH)
This also fixes the number of items in the response which are specified in BP and BQ in the request
to test:
a) create a manual invoice for patron 23529000035676 : http://localhost:8081/cgi-bin/koha/members/maninvoice.pl?borrowernumber=19
b) in ktd call: perl /usr/share/koha/bin/sip_cli_emulator.pl -a 127.0.0.1 -p 6001 -su term1 -sp term1 -l CPL --patron 23529000035676 -m patron_information -s " Y "
c) verify that no |AV field is in response
d) apply patch
e) in ktd call: perl /usr/share/koha/bin/sip_cli_emulator.pl -a 127.0.0.1 -p 6001 -su term1 -sp term1 -l CPL --patron 23529000035676 -m patron_information -s " Y "
f) verify that response includes fields like '|AVManual fee '
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Tidied inline
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 1d80470105)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit d140000c98)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
If an invalid or empty cardnumber is supplied to patron status request SIP message, SIP dies silently and no 'READ:' exists on the response.
Test plan:
1) Apply tests plan, run tests:
$ prove t/db_dependent/SIP/Message.t
2) Verify tests fail. Apply 2nd patch. Run tests again. Verify they pass.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 87256d7ae3)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 4a460068a8)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
And copy fix across to Zebra search as well.
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Thomas Klausner <domm@plix.at>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 7c40544951)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 97477f9258)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Items with damaged status are shown on the OPAC results page as "Not
available" even with AllowHoldsOnDamagedItems set to 'Allow', which is
misleading for the users. 'other/Damaged' status should be assigned
only if AllowHoldsOnDamagedItems is set to 'Don't allow'.
Test plan:
==========
1. Check that AllowHoldsOnDamagedItems system preference is set to
'Allow'.
2. In librarian interface, change the damaged status of an item by
setting it to 'Damaged'.
3. In OPAC, make a search for the record with this item attached. Use
common words from title to get a list and not a single record.
4. Note that the item in question is labelled as 'Not available'
(Damaged).
5. Apply the patch; restart_all.
6. Repeat p. 3. Note that the item is now labelled as 'available for
loan'.
7. Set AllowHoldsOnDamagedItems system preference is set to 'Don't
allow'.
8. Repeat p. 3. Note that the item is now labelled as 'Not available'.
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit c3dc86286c)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit de82706184)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
No idea if this is a real bug. This code is fixing the following test
failure:
t/db_dependent/Circulation/CalcFine.t .. 1/7
# Failed test 'Amount is calculated correctly'
# at t/db_dependent/Circulation/CalcFine.t line 271.
# got: '0'
# expected: '6'
# Looks like you failed 1 test of 2.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 5776f28efa)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 848d6e07ef)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This came up with a SIP vendor recently - when reading responses they were only getting part of a patron's information.
It seemed to have been caused by patrons with multiple restrictions and a new line in the response
This patch also does minor refactoring to write_msg to pass the server variable that contains
all the previously passed parameters, and removes the never used "file" parameter.
Test Plan:
1) Add multiple debarments to a patron
2) Run a sip patron information response, note the presence of newlines
3) Apply this patch
4) Add the new option convert_control_characters to your SIP account,
set the value to " -- "
5) Restart all the things!
7) Run a sip patron information response, note the newlines have been replaced!
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 6a20ac7f99)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit d76b6a9b42)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
It appears that the template parser parses HTML tags first and then template
toolkit tags. This can cause a template toolkit tag that contains an HTML tag
to have its start and end markers separated. This causes it to be treated as
text that can be translated instead of a template toolkit tag.
This patch searches for text sections that have a template toolkit end marker
without a start and then searches for the start in previous sections. It then
creates a new template toolkit section with the start and end markers.
The action buttons in the staff Lists view have been changed to allow
translation.
To test:
1. You will need to edit the staff-prog.po for a language and modify the
the translation for "SET line_break". You can change SET to FOO.
2. Install the translation for the language.
3. View the details of a patron in the staff interface with the language.
4. The page will have an error.
5. Apply the patch.
6. Install the translation for the language.
7. View the details of a patron in the staff interface with the language.
8. The page should now display correctly.
If you want to, you can run "gulp po:update --lang LANGUAGE-CODE" to make sure
that the template tag is no longer included in .po file.
You can also add translations for "Edit", "Delete", and "Transfer" in
messages.po to make sure that the action buttons are translated in the Lists
view.
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Amended-by: Jonathan Druart
Tidy
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit cf634fa014)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 2d2e2bbb5a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
When exporting a framework as csv, the exporter does not check the presence of double quote in the fields. Hence, if there is one double quote, the csv is broken.
TEST PLAN:
1 - Change a framework to add a field containing double quote in name
2 - Export it in csv
3 - Create a new framework
4 - Import the csv in the new framework -> every fields after the one
containing double quotes should be broke. Every other fields should have
no subfield
5 - APPLY PATCH
6 - Repeat 2-5 -> everything should be correctly exported
Signed-off-by: Sukhmandeep Benipal <sukhmandeep.benipal@inLibro.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 5f45818cf7)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 9cc99b3eaf)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
1. Do an item search that returns results
2. Use the column filtering available at the top of the table for each column
3. Try itemnumber, get a 500 error each time
4. As long as there is data in the itemnumber column and you attempt to use another column you'll see a 500 error.
5. APPLY PATCH, restart_all
6. The itemnumber column filtering should now work as expected
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit a84a5fc7d0)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 910898302f)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
When parsing the branch limits the regular expression matches
parameters that contains the substring "branch:" rather than the prefix
"^branch:". Consequently, both prefixes homebranch: and holdingbranch:
triggers the branch limit.
Test plan:
- Activate the system preference IntranetAddMastheadLibraryPulldown.
- In staff interface:
- Perform a catalogue search (e.g. "book").
- Click on a facet for holding library or home library
(e.g. "Fairview").
- Click on the "more options" icon in the search box and make sure
that "All libraries" is selected.
- Activate the system preference OpacAddMastheadLibraryPulldown
- In opac:
- Perform a catalogue search (e.g. "book").
- Click on a facet for holding library or home library
(e.g. "Fairview").
- Make sure "All libraries" is still selected in the dropdown next
to the search input.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit a6457c14aa)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit c4721f5798)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
_wrap_html returns a header referring to http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd and http://www.w3.org/1999/xhtml. These should be https links.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit e27c3a6090)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit e69480bfb7)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Test plan:
1) Apply only LDAP rearrangement patch
2) Run that test file (to prove the rearrangement does not break tests):
$ prove t/db_dependent/Auth_with_ldap.t
3) Verify tests pass
4) Apply LDAP test patch on top
5) Run the test file. Notice it fails.
6) Apply this patch. Run LDAP tests again. Verify tests pass.
Co-authored-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 4c1e6b5e71)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit bc5556acd3)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Without this rearrangement, C4::Context->config('useldapserver') is always 0.
It seems that because its inside a BEGIN block, the mock coming from .t file does not get picked up
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit e3d071ac54)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 8d9d78493d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Test plan:
1) Apply only Shibboleth tests patch
2) Run that test file:
$ prove t/db_dependent/Auth_with_shibboleth.t
3) Verify tests fail with the updated_on error message.
4) Apply this patch. Repeat 2) Verify tests now pass.
Co-authored-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit ce9c97cda3)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit a9b9f587ce)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 8b691a2b9c)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit c61e3e9d11)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch adds a new key 'notconsidered' to the authority cache when
linking to avoid doubling when creating new authorities and wishing
to ignore thesaurus
To test:
0 - Set LinkerConsiderThesaurus to "don't"
1 - Set AutCreateAuthorities to generate
2 - Set AutLinkBiblios to Do
3 - Set CataloguingModuleRelink to Do
4 - Save a new record in Koha with the same randomized heading repeated
but from 3 different authority sources
ensure source is defined by indicators only and by field $2 once
ensure the heading is random so that no matches will be found
5 - Confirm each authority is linked to a new unique authority
6 - Apply patch, restart all
7 - Repeat 4 with a new subject heading
8 - Confirm all headings are linked to the same authority
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 1894fc5101)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 88d9ea0ea8)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
The system is vulnerable to Formula Injection attacks as the data
stored within the database and exported as CSV/Excel is not being
sanitized or validated against implanted formula payloads
This patch modifies all uses of Text::CSV and derived classes to pass
the "formula" parameter with value of "empty" which replaces formulas
by empty string.
Test Plan:
1) Apply this patch
2) For guided_reports.pl, attempt to export CSV where you've set a column to a formula somehow
( such as "=1+3" )
3) Export that CSV file
4) Note the formula has not been exported
5) Repeat this plan for the remaining scripts that export CSV files
where users can define the outputted data
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Fixed two conflicts. I have tested that this works as advertised on:
- Reports (Download > Comma separated text (.csv)) [Text::CSV::Encoded]
- Circulation > Overdues > Download file of all overdues [Text::CSV_XS]
- misc/export_borrowers.pl [Text::CSV]
This covers all modules used, and both GUI and command line.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Change none to empty in the commit message ! None is the default,
doing nothing. Empty clears the formulas.
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit e588f810a521065bf46dc037edeac5c83d537714)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch adds a new check in UpdateTotalIssues to check that we are changing the number
of total issues before calling ModBiblio
To test:
0 - Enable CataloguingLog
1 - Checkout an item
2 - Run : misc/cronjobs/update_totalissues.pl --use-stats --commit=1000 -v
3 - In report, note all biblios were updated
4 - Check action_logs - note a new entry for every biblio
5 - Apply patch
6 - Repeat
7 - Note no biblios reported updated
8 - Note no new cataloguing log entries
9 - Checkout the item again
10 - Run again
11 - Note biblionumber has updated count in verbose output
12 - Note report only rpeort 1 biblio modified, the rest only processed
13 - Only one line added to action_logs
14 - Run it again
15 - Confirm no updates
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit d7b36d7f69)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit a40b6d538d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Because labels/label-edit-batch.pl fills a DataTable with things that include
a link created by C4/Creators/Lib.pm, it outputs them with the $raw filter,
so HTML in author/title/callnumber is executed in the label batch editor.
While we wait for a fix that moves the link creation into the template and
out of C4, encoding HTML in Lib.pm for the bits going into the link, and
switching from $raw to the html filter for the rest of the things, will at
least get rid of the XSS.
Test plan:
1. Without this patch, but with the patch from bug 37654 so you don't get
alert()s in batch import, download attachment 170675 [details]
2. Cataloging - Stage records for import - browse to the downloaded file -
Upload file - when the upload finishes Stage for import - when staging
finishes View batch (get alert()s if you didn't apply bug 37654) - Import
this batch into the catalog
3. Once the import finishes, Cataloging - Manage staged records
4. In the row for your import, in the # Items column, click "(Create label
batch)"
5. In the "Label batch #n created" message, click the link to the batch #
6. Because the batch includes a call number with an open <script>, you'll
get XSS alert()s and then one about something going wrong while loading
the table, with only one of the two records showing in the batch editor
7. Apply patch, restart_all
8. Cataloging - Label creator - Manage Label batches
9. In the row for your batch, click Edit
10. You will see both labels, with their attempts at XSS visible as text
rather than being interpreted as HTML
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch moves the error check right before the ->check_columns call.
This is how main and 24.05 behave. 23.11 doesn't have bug 35907
backported so things are not exactly the same. With this patch tests
pass and the only difference in behavior is logging.
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Add shebang to Guided.t too.
Test plan:
See also previous commits.
Try sql like:
select access_token from oauth_access_tokens
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
This patch replaces these variables with a non-translatable message.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Confirm tests pass t/db_dependent/Reports/Guided.t
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
This enhancement prevents SQL queries from being run if they would return a password field from the database table.
To test:
1. Run tests and notice they fail t/db_dependent/Reports/Guided.t
2. Apply patch and restart services
3. Create a public report with an SQL report which would access a password column in a database table
4. Try to run the report. Notice you are met with an error and the results are not shown.
5. Access the JSON URL, you should not get the results and should be shown an error
6. Confirm tests pass t/db_dependent/Reports/Guided.t
Sponsored-by: Reserve Bank of New Zealand
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Fixes the following error message when running the overdues check cronjob on a
Koha system without defined overdue rules:
/etc/cron.daily/koha-common:
Use of uninitialized value in string eq at /usr/share/koha/lib/C4/Overdues.pm
line 686.
by checking if the variable is defined before comparing it.
Test plan:
1. Go to Tools - Overdue notice/status triggers and verify that for every single
patron type for both Default and every individual library, you have no value
set for Delay, so that you will never send anyone an overdue notice
2. Run the cron job which creates and sends overdue notices
3. Confirm the above mentioned error no longer appears
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 4c8586270a)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 319f954c21)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Test plan using koha-testing-docker:
1) Make sure SIP is running. You may need to edit
/etc/koha/sites/SIPconfig.xml and remove the 8023 connector and
restart the SIP-server (koha-sip --restart kohadev)
2) Find a patron, say 23529000197047
3) Set a password by selecting "change password", set it to
"Password1234"
4) Find a book, say 39999000000856
5) Issue book to patron with sip-client:
sudo koha-shell -c "/usr/share/koha/bin/sip_cli_emulator.pl \
--address localhost --port 6001 -t cr \
--su term1 --sp term1 --message checkout \
--location CPL --item 39999000000856 \
--patron 23529000197047 --password Password1234"\
kohadev
6) Note the AH-header in the response which for example:
'AH20240619 235900'
7) Make a renewal with:
sudo koha-shell -c "/usr/share/koha/bin/sip_cli_emulator.pl \
--address localhost --port 6001 -t cr \
--su term1 --sp term1 --message renew \
--location CPL --item 39999000000856 \
--patron 23529000197047 --password Password1234"\
kohadev
8) Make sure the AH-header in the response is different from the
response to the checkout, for example: 'AH20240624 235900'
Signed-off-by: Tadeusz „tadzik” Sośnierz <tadeusz@sosnierz.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 3295fd5227)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 82f15de4fb)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
If you enabled AutoLocation and have a branch without ip, this
triggers warnings.
Test plan:
Check logs in this situation with/without this patch by logging out
and in again on staff.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 2f1ffbc6ec)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 2d4537ba12)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
We keep OPEN when people still use log_file or setsid.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit c0d76f707b)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 2c156f8ce1)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
My Koha testing docker SIP started dying repeatedly after launch. After investigation, I
found it was a problem with logging and default ports.
In D12 there is no syslog anymore, everythign uses journal. Four our purposes, lets log SIP issues
to sip.log by default
Attaching a patch to clear things up.
To test:
1 - Open KTD/D12
2 - tail -f /var/log/koha/kohadev/*.log
3 - On another terminal 'restart_all'
4 - Wait a bit, notice SIP dying
5 - Apply patch
6 - Update SIPconfig:
server-params:
log_file='/var/log/koha/kohadev/sip.log'
service with port 8023:
port="127.0.0.1:8023/tcp"
7 - Restart all
8 - Confirm SIP no longer dies
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 5dc1ec387d)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 7076762bba)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Some file tidying to pass the QA tests
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 361ec4b2ea)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit eff4e19ef8)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Before this patch if a record had a 751 and a 781 you could have fields repeated.
This patch reduces the scope of the fields to subdivision variable as it is only used in processing 7xx
fields and should not be shared between fields.
I also add unit tests
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 95f2aecc1b)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 4ca639a5f6)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Currently when searching for a geographic authority record the search will fail if the record has a heading in a 78X field. The system tries to do a regex match against an undefined variable causing an error. This patch makes that regex match conditional on the variable being defined to allow the search to succeed.
Test plan:
1) Navigate to Authorities
2) In the search bar at the top of the page, click on the dropdown options and in the 'Authority type' field, select 'Geographic Name'
3) Click search
4) You should have a list of authorities
5) Click on any authority record and then click edit and select to edit the record
6) Click on the "7" button
7) Click on the green text next to the '781' field to get the list of fields
8) In field 'v' enter any string you like
9) Click save
10) Repeat steps 1-3, this time it should display an error message for an Unmatched [ in regex
11) Apply patch
12) restart_all
13) Refresh the page, the results should show and the string you entered in the 'v' field should display on the record you edited
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
(cherry picked from commit 6c9482f213)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 6dfb1dd931)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch moves the language selection into GetPreparedLetter, drops
the interface check step and ensures the default template always uses
the default include language as per the OPACLanguages settings.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit c50bb140a8)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This restores the final fallback to 'en' as mentioned by Jonathan
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 45e4d9a04a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit ef558f072f)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch set the language used in slips folloinw this logic:
--> uses patron's preferred language
--> if patron's preferred language is 'default', use the interface language
--> if there is no interface (for overdue_notices for example), use the first language in 'language' system preference
To Test:
1. Install the other language (i used fr-CA here)
1.1.
gulp po:update fr-CA
./misc/translator/translate install fr-CA
1.2. In Administration > Global system preferences, search for language and check the added language
2. Create a manual invoice in a patron's account and pay it
3. From the Transactions tab, click 'Print' next to the payment line
--> On the printed slip, there's the word 'Payment' in English (OK)
4. Switch interface to other language
5. Redo step 3
--> On the printed slip, the word 'Payment' is still in English (not ok)
6. In Administration > Global system preferences, enable TranslateNotices
7. Go to Tools > Notices and slips > ACCOUNT_CREDIT and copy the content of the letter into all the languages
8. Redo step 3 (you should still be in the other language interface)
--> On the printed slip, the word 'Payment' is still in English (not ok)
9. Edit the patron's account and change the preferred language to the other language
10. Redo step 3
--> On the printed slip, the word 'Payment' is in the other language (Paiement) (OK)
11. Apply the patch
12. Reset config
12.1. Edit the patron's account and change back the preferred language to 'default'
12.2. In Administration > Global system preferences, disable TranslateNotices
13. Redo step 3 (you should still be in the other language interface)
--> On the printed slip, the word 'Payment' is in the other language (Paiement)
14. Switch interface to the english language
15. Redo step 3
--> On the printed slip, the word 'Payment' is in English
16. In Administration > Global system preferences, enable TranslateNotices
17. Edit the patron's account and change the preferred language to the other language
18. Redo step 3
--> On the printed slip, the word 'Payment' is in the other language (Paiement)
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 4f7ae9c1c4)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Actually in _get_tt_params
The following query will delay the response
SELECT `me`.`biblionumber`, `me`.`frameworkcode`, `me`.`author`, `me`.`title`, `me`.`medium`, `me`.`subtitle`, `me`.`part_number`, `me`.`part_name`, `me`.`unititle`, `me`.`notes`, `me`.`serial`, `me`.`seriestitle`
, `me`.`copyrightdate`, `me`.`timestamp`, `me`.`datecreated`, `me`.`abstract`
FROM `biblio` `me`
WHERE `biblionumber` = '1) AND (SELECT 1 FROM (SELECT(SLEEP(6)))x)-- -'
ORDER BY field( biblionumber, 1 ) AND (
SELECT 1
FROM
SELECT SLEEP( 6 ) x
) -- - )
To test
1/ Add some items to your cart in the opac
2/ Choose send cart
3/ Open firefox developer tools and switch to the network tab
4/ Send cart
5/ In the network tab, find the post request and choose copy as curl
6/ Edit the curl command to add )+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))x)--+- to the bib_list parameter
7/ Run the curl notice it takes a long time to respond, if you want to check run the curl without the above part added
8/ Apply the patch and restart plack
9/ Run the modified curl and notice no longer the slow down
10/ Test in browser and make sure the basket is still sent
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
(cherry picked from commit 0b3c98b0ba01ea5c886ecfe8eef174b5b7c6ec25)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Kyle M Hall
David Cook
Jonathan Druart
Marcel de Rooy
Magnus Enger
Jan Kissig
Jan Kissig
Pedro Amorim
Aleisha Amohia
Paul Derscheid
Janusz Kaczmarek
Kevin Carnes
Emily Lamancusa
Baptiste Wojtkowski
Lucas Gass
Andreas Jonsson
Baptiste Wojtkowski
Nick Clemens
Tomas Cohen Arazi
Aleisha Amohia
Martin Renvoize
Denys Konovalov
Matt Blenkinsop
Hammat Wele