Upon submitting the unauthenticated request, the user is now redirected to a different page and the request details are passed through a session variable. This is to prevent the user from being able to resubmit the same unauthenticated request multiple times (see security bug 39611)
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Feedback provided by David Cook + Matthias Meusburger at KohaCon24
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Moved unauth data to their respective illrequestattributes entries
instead of staffnotes + opacnotes.
Update confirmation message
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Move this out of Standard specific logic.
Other backends that support unauthenticated requests may want to make use of this and not duplicate code.
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Move this out of Standard specific logic.
Other backends that support unauthenticated requests may want to make use of this and not duplicate code.
Also make these notes translatable.
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
The list of backends in the dropdown in this page:
http://localhost:8080/cgi-bin/koha/opac-illrequests.pl?op=create
If unauthenticated is enabled, this is listing all backends, instead of
making use of opac_available_backends.
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This was incorrectly keeping backends that don't support unauthenticated ILL requests if more than one existed.
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This makes it so that the Auto ILL stage on OPAC only queries opac_available_backends.
Fix is submitted here and not in bug 35604 because it's here that opac_available_backends is implemented.
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
prove t/db_dependent/Koha/REST/Plugin/PluginRoutes.t
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
0) If k-t-d, run updatedatabase (ignore this if testing on a sandbox)
1) Enable ILLModule syspref:
{staff_url}/cgi-bin/koha/admin/preferences.pl?tab=&op=search&searchfield=ILLModule
2) No need to install a backend as 35570 is in the tree
3) On a different browser session, without being lgoged in, access the create ILL request OPAC page directly:
{opac_url}/cgi-bin/koha/opac-illrequests.pl?method=create&backend=Standard
4) Notice you're presented with the login page, as expected
5) Enable ILLOpacUnauthenticatedRequest:
{staff_url}/cgi-bin/koha/admin/preferences.pl?tab=&op=search&searchfield=ILLOpacUnauthenticatedRequest
6) Repeat step 3) Notice you now get the create ILL request form, with some additional inputs at the top specific to an unauthenticated request (first name, last name, e-mail address)
6.5) (optional) Confirm the 'Make an Interlibrary loan request' link exists at the bottom of the search results page, while unauthenticated on OPAC:
{opac_url}/cgi-bin/koha/opac-search.pl?idx=&q=music&weight_search=1
This should only show for authenticated OPAC users if ILLOpacUnauthenticatedRequest is off.
7) Test the form, try submitting with some blank fields, change type and library after and before inputing data in the input fields, etc.
8) Submit the form successfully. Notice you're presented with the unauthenticated request submission confirmation screen with a message and request details.
9) Go back to Staff UI, logged in, access ILL requests and confirm the unauthenticated request submitted through the OPAC is there:
{staff_url}/cgi-bin/koha/ill/ill-requests.pl
10) Test that you can add a patron afterwards, if needed, by clicking 'Edit request' on the toolbar of the manage request page, and entering a patron ID
11) Test that you're able to 'confirm' the request by clicking 'Confirm request', as if it was a regular 'NEW' request.
Additional testing:
Make sure existing ILL functionality interacts with this new optional workflow behavior.
For this, we're using ILLModuleDisclaimerByType. ILLCheckAvailability or AutoILLBackendPriority can also be used but require more setup (plugins, credentials, etc)
1) Configure ILLModuleDisclaimerByType, visit
{staff_url}/cgi-bin/koha/admin/preferences.pl?tab=&op=search&searchfield=ILLModuleDisclaimerByType
2) Click the 'edit' link at the bottom of the syspref and copy the example code from the description into the text box. Save.
3) Repeat the original test plan from above, but make sure the request type is not 'article' (as that type is bypassed). Use 'journal', for example. Submit the request making sure you fill in all mandatory fields.
4) Notice you're now presented with the ILL request disclaimer screen, hit Submit. Notice the request is created as before.
5) Return to Staff UI, logged in, confirm this 2nd unauthenticated request has been created and the type disclaimer info is stored and presented when viewing the request.
Run tests (k-t-d only):
prove t/db_dependent/Koha/ILL/Request/Config.t
prove t/db_dependent/selenium/opac_ill_requests.t
Sponsored-by: NHS England (National Health Service England)
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Show the 'Make an ILL request' link for
unauthenticated users in the OPAC search results page
if ILLOpacUnauthenticatedRequest is enabled.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
/cgi-bin/koha/opac-illrequests.pl was an authrequired page
Now, its authnotrequired if creating or viewing an unauthenticated
request
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
unauth_view to show request details after its been submitted
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Skip for unauthenticated requests
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
- Do not validate borrower if its an unauthenticated request
- Set borrowernumber to null if its an unauthenticated request
- Add staff and OPAC notes with unauthenticated request info
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Validating an unauth request form requires checking for unauth info
fields.
Validating a regular authenticated request requires checking for
borrower information.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Assign this new UNAUTH status for unauthenticated requests
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This also makes sure an empty left side bar exists for opac unauthenticated screens
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch removes the error class from the table of late transfers.
Instead, the days late status is shown as a Bootstrap badge. The patch
also adds pluralization to the string so that it adapts based on the
number of late transfers.
To test you would ideally have multiple pending transfers to your
library, some late and some not. This will presumably require manually
updated your database to change the date of pending transfers.
- Make at least one transfer multiple days late by changing the
`datesent` value to a date late enough to exceed the number of days
defined in the TransfersMaxDaysWarning system preference.
- Make at least one transfer only one day late.
- When you go to Circulation -> Transfers to receive you should see
badge-style labels on the transfers which are late.
- The text of the labels should be correct according to the number: "1
day late" or "XX days late"
Sponsored-by: Athens County Public Libraries
Signed-off-by: Anneli Österman <anneli.osterman@koha-suomi.fi>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
To test:
1. Place a booking on an item.
2. Click on edit to open the Edit booking modal.
3. The item type will be de-selected, and the booking dates calendar will be locked until the item type is re-selected.
4. APPLY PATCH
5. Try steps 1 - 3 again, this time the proper item type should be selected and the date field will not be locked.
6. Try creating a new booking, making sure everything still works as excepted.
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Test plan
1) Navigate to ERM module
2) Click into agreements, page should load as normal
3) Click New agreement, form should load as expected
4) Fill in the required fields - note that the Status field is correctly populated with authorised values
5) Save new agreeement
6) Note that the status column in the table is correctly populated
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch adds a method to initialise the authorised values in a vue app. It will automatically load authorised values into the app and store them in the store for your app. The intent behind this is to make adding authorised values into a Vue app much simpler and more DRY, especially when creating a new vue app. You will just need to add your desired authorised values into the store for your app and they will be loaded automatically
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Add the option "--without_restriction_type" so that delete_patrons.pl
does not delete patrons with given restriction types.
To test:
1) Run
misc/cronjobs/delete_patrons.pl --not_borrowed_since 2010-01-01
and choose a borrowernumber that would be deleted.
2) In your browser go to
/cgi-bin/koha/members/moremember.pl?borrowernumber=<borrowernumber>
and add a manual restriction to this patron.
3) Apply the patch.
4) Run
misc/cronjobs/delete_patrons.pl --not_borrowed_since 2010-01-01 \
--without_restriction_type MANUAL
5) Check that the patron with the manual restriction would not be
deleted.
Sponsored-by: Karlsruhe Institute of Technology (KIT)
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Thomas Klausner <domm@plix.at>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Add unit tests for testing the new parameter without_restriction_types
of C4::Members::GetBorrowersToExpunge().
Sponsored-by: Karlsruhe Institute of Technology (KIT)
Signed-off-by: Thomas Klausner <domm@plix.at>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Thomas Klausner <domm@plix.at>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Test plan:
Test plan:
This test plan involves running a cronjob, not sure how easy this is in the sandboxes
1) In system preferences, click Search and then select the Acquisitions option from the left hand menu
2) Enable MarcOrderingAutomation
3) Paste the following into MarcFieldsToOrder
price: 975$p
quantity: 975$q
budget_code: 975$h
4) Paste the following into MarcItemFieldsToOrder
homebranch: 949$a
holdingbranch: 949$b
itype: 949$y
nonpublic_note: 949$x
public_note: 949$z
loc: 949$c
ccode: 949$8
notforloan: 949$7
uri: 949$u
copyno: 949$t
price: 949$g
replacementprice: 949$v
itemcallnumber: 949$o
quantity: 949$k
budget_code: 949$l
Now save the sysprefs
5) In the administration homepage, under Acquisition parameters there should now be a link called "MARC order accounts"
6) Click on this and click the New account button
7) Choose a vendor and a budget
8) Enter a description and make sure you don't set a value in the 'Basket name field' input
9) Enter the following in download directory - "/var/lib/koha/kohadev/tmp/koha_kohadev_upload"
10) Select any record matching settings you want (not important for the test plan, this uses the same code as the marc file staging that already exists in Koha)
11) Check Yes under Check for embedded item record data
12) Click submit
13) We now need to upload a MARC file into the directory that we put in the account. The easiest way to do this is through the marc staging tool
14) Navigate to Cataloging > Stage MARC records for import
15) Upload the file attached to this bug using the Choose file button
16) Click Upload file.
17) Leave the page without completing the new form that appears, we don't want to stage this file. The file we uploaded is now in the directory ready for the cronjob to process as if it had been transferred via SFTP.
18) In the CLI run, perl misc/cronjobs/marc_ordering_process.pl -v -c
19) The logging should show that the file has been processed for that account
20) Navigate to Acquisitions
21) Search for the Vendor that you put in the MARC ordering account
22) There should now be a basket titled: '{random_hash}_orderstest.marcxml'
23) In the ordering account, set the 'Basket name field' to be 975$a
24) Repeat steps 14 -22, the basket should now be called "This is the basket name" which has been pulled from the file
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Thomas Klausner <domm@plix.at>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Thomas Klausner <domm@plix.at>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Thomas Klausner <domm@plix.at>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch adds the borrowernumber as a parameter to the overwrite_calc_fine
plugin hook. E.g., the borrower is needed for calculating graduated fines.
Sponsored-by: Karlsruhe Institute of Technology (KIT)
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch avoids the introduction of a `foreach` loop and a `return`
call inside of it, by using grep on the array assignment, and then just
returning the first element on it, if any.
No behavior change is expected.
The code becomes easier to read and spot what is doing.
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This new hook allows to overwrite the koha standard calculation of fines.
This can be useful if your library has a fine policy with graduated fines
per overdue letter.
To test:
1) Apply patch.
2) Run prove -v t/db_dependent/Circulation/CalcFine.t
3) Run prove -v t/db_dependent/Koha/Plugins/Overdues.t
4) Sign off.
Sponsored-by: Karlsruhe Institute of Technology (KIT)
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Tomas Cohen Arazi
Pedro Amorim
Pedro Amorim
Owen Leonard
Lucas Gass
Matt Blenkinsop
Matt Blenkinsop
Jonathan Druart
Raphael Straub
Katrin Fischer
Nick Clemens