Signed-off-by: Hugo Agud <hagud@orex.es>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Hugo Agud <hagud@orex.es>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Adds a "cite" option in the tools menu in OPAC detail page for easy citations.
Test plan:
1. Apply this patch
2. Got to OPAC detail page
3. In the tools menu to the right, click the new "Cite" link
4. A modal should appear with four different citation styles (APA, Chicago,
Harvard, MLA)
Sponsored-by: Regionbibliotek Halland / County library of Halland
Signed-off-by: Nicole Engard <nengard@bywatersolutions.com>
Signed-off-by: Hugo Agud <hagud@orex.es>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
When user inputs were appended directly to the barcode table, the values were not properly escaped, allowing potential XSS attacks. This patch ensures that user inputs are sanitized and safely added to the DOM using .text() and .attr() methods to prevent script injection.
To test:
Enable the "SelfCheckInModule".
Open the barcode input form.
Enter a barcode with HTML or script tags.
Without the patch, observe that the script is executed.
Apply the patch.
Repeat step 2.
Verify that the input is escaped and no script execution occurs.
Check that the barcode is properly appended to the table.
Documentation:
No updates required.
Sponsored-by: KillerRabbitAos
Signed-off-by: Bo Gustavsson <bosse@gustavsson.one>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This change removes the Koha version number from the OPAC generator
metadata.
Test plan:
0. Apply patch
1. Enable syspref SelfCheckInModule
2. Visit /cgi-bin/koha/opac-main.pl and confirm meta tag doesn't
include version number
3. Visit /cgi-bin/koha/sci/sci-main.pl and confirm meta tag doesn't
include version number
4. Visit /cgi-bin/koha/sco/sco-main.pl) and confirm meta tag doesn't
include version number
5. Click "Help" and confirm meta tag doesn't include version number
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch adds formula=empty to:
- Koha::ERM::EUsage::SushiCounter::_build_COUNTER_report_file()
Updated 2024-09-26: Earlier version also removed unnecessary
use of formula=empty from two places.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
The system is vulnerable to Formula Injection attacks as the data
stored within the database and exported as CSV/Excel is not being
sanitized or validated against implanted formula payloads
This patch modifies all uses of Text::CSV and derived classes to pass
the "formula" parameter with value of "empty" which replaces formulas
by empty string.
Test Plan:
1) Apply this patch
2) For guided_reports.pl, attempt to export CSV where you've set a column to a formula somehow
( such as "=1+3" )
3) Export that CSV file
4) Note the formula has not been exported
5) Repeat this plan for the remaining scripts that export CSV files
where users can define the outputted data
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Fixed two conflicts. I have tested that this works as advertised on:
- Reports (Download > Comma separated text (.csv)) [Text::CSV::Encoded]
- Circulation > Overdues > Download file of all overdues [Text::CSV_XS]
- misc/export_borrowers.pl [Text::CSV]
This covers all modules used, and both GUI and command line.
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Change none to empty in the commit message ! None is the default,
doing nothing. Empty clears the formulas.
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
To test:
1. Change the `dateformat` syspref to any value other than `us`(shows as mm/dd/yyyy)
2. Run:
$ ktd --shell
k$ prove t/db_dependent/SIP/Transaction.t
=> FAIL: Tests fail because of the resulting string containing an unexpected date format.
3. Repeat 1-2 with other formats
=> FAIL: SAme
4. Choose `us`
5. Repeat 2
=> SUCCESS: It passes
6. Apply this patch
7. Repeat 2
=> SUCCESS: Tests pass!
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
You are permitted to delete ILL batch statuses that you (rather than the
system) add, but the UI didn't get the CSRF memo about delete ops needing to
be POSTs with op="cud-delete", so it still uses a GET of ?op="delete" and
fails.
Test plan:
1. Set the preference ILLModule to 'Enable'
2. Administration - Interlibrary loan batch statuses - New batch status
3. Give it a name, an uppercase code, and Save
4. Click the Delete button to the right of your new status
5. The page is blank, and if you navigate back to Interlibrary loan batch
statuses, you'll see that yours was not deleted
6. Apply patch, reload page
7. Click the Delete button to the right of your new status, verify it is
deleted
Sponsored-by: Chetco Community Public Library
Signed-off-by: Sam Sowanick <sam.sowanick@corvallisoregon.gov>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This does not belong here, but raised to me here, so attaching on this
one.
This feels like it's coming from bug 33484, but those tests were passing
after it has been pushed.
This patch fixes the following error:
Error while executing command: stale element reference: The element reference of <input type="text"> is stale; either the element is no longer attached to the DOM, it is not in the current frame context, or the document has been refreshed at /usr/share/perl5/Selenium/Remote/Driver.pm line 411.
Since bug 33484 the row with the filters is redrawn on table redraw. So
we need to search for the input every time the table is redrawn.
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This follow up enhances the sip_cli_emulator.pl to use start-item and/or end-item as params. With these new params the original test plan can be extended:
Test plan:
a) create several manual invoices for patron 23529000035676 : http://localhost:8081/cgi-bin/koha/members/maninvoice.pl?borrowernumber=19
b) run
perl misc/sip_cli_emulator.pl -a 127.0.0.1 -p 6001 -su term1 -sp term1 -l CPL --patron 23529000035676 -m patron_information -s " Y " --start-item=1 --end-item=2
to get fine 1 and 2 or
perl misc/sip_cli_emulator.pl -a 127.0.0.1 -p 6001 -su term1 -sp term1 -l CPL --patron 23529000035676 -m patron_information -s " Y " --start-item=3 --end-item=3
to retrieve fine 3
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
The original implementation of fine items was accidently overwritten with this patch. This follow up reverts these changes but keeps additional improvements that were also part of this patch.
These are:
- Returning the active currency as part of the response (BH)
- Fixing the number of items in the response which are specified in BP and BQ when other items as fine items are requested.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch makes several changes to make the updated forms more
consistent with how other pages work:
- Form labels should have ":" after them.
- Form fields should have a hint when they are required.
- Required fields should not be indicated with an asterisk.
- In the OPAC, <select> should have a "form-select" class if the form is
otherwise being styled with Bootstrap classes.
- Primary submit buttons should have a "btn btn-primary" class.
- The Font Awesome 6 icon for a delete operation is "fa-trash-can."
- Error messages should be wrapped in <div class="alert alert-warning">.
- All language strings in JS files should be wrapped in __('').
- Terminology: "Library" instead of "Branch," "Patron" instead of
"Member."
Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
It was missing in the JS that adds new empty custom fields.
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
In the prepopulated fields when editing item metadata that had custom
fields (tt generated). So it's consistent when adding new empty fields
(done in JS)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
qa tools throw:
ill_text_input_field: not found
But I believe this is a false positive.
We can clearly see it working by going to:
http://localhost:8080/cgi-bin/koha/opac-illrequests.pl?op=add_form&backend=Standard
And picking 'DVD' or any other type.
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This refactors the code for more DRY
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Adding an !important override to installer.scss isn't ideal but it's
an acceptable interim solution pending a more thorough review of how we
customize Bootstrap's text-* classes.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Update the font colors for info, warning, and database errors on the web
installer to meet WCAG accessibility guidelines for color contrast.
For the yellow text, it is impossible to meet minimum contrast levels on
a white background without losing the yellow-ness of the yellow. This
patch opts for a dark text color with a light yellow highlight, to
meet contrast standards while allowing the yellow to be easily
distinguished from other message colors.
To test:
1. Apply patch for test dbrev
2. Trigger a database update from the web installer
In KTD this can be done by:
i. Changing the Version system preference to a slightly lower
number (for example, from 24.0600057 to 24.0600056)
ii. Reload the staff client
iii. Log in with koha_kohadev, password
--> Note that the blue and yellow colors are very light
3. If possible, use browser tools to check the accessibility of the
different colors of text (in Firefox, right click on the text and
choose "Inspect accessibility properties")
--> Note that some of the text does not meet WCAG accessibility standard
4. Apply this patch and yarn build
5. Clear browser cache and refresh the page
--> Note that the blue and yellow text is more readable
6. If possible, repeat step 3
--> Note that all text now meets WCAG standards
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
BTW, tiny adjustments to existing tests to work with modified
C4::Suggestions::ModSuggestion.
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
When processing a new order (creating basket, receiving order, etc.)
using a bibliographic record once already linked to an old
suggestion (already completed in the past), Koha generates and sends
a confirmation letter that should not be sent at all.
This is because suggestions in Koha are linked to a biblionumber (and
not the order), and so the old suggestion is identified - erroneously -
as relevant. Then C4::Suggestions::ModSuggestion sends a letter
whenever it receives STATUS as a parameter, paying no attention to
whether the status is changed. So, in this case, a suggestion already
in the status AVAILABLE is "updated" to the status AVAILABLE and the
letter is generated. To solve this problem, it should be enough to
check whether STATUS is actually changed.
Test plan:
==========
1. As a patron, make a purchase suggestion. As a librarian, accept it and
process it, as usual, through the acquisition process.
2. At the patron account, as librarian, check the generated notices (the
most recent should be "Suggested purchase available").
3. Make a new aquisition order for the same bibliographic record
("From an existing record:") and receive it as usual.
4. Go to the account of the patron that made the original suggestion and
check the notices. Note the second, irrelevant letter "Suggested
purchase available".
5. Apply the patch; restart_all.
6. Repeat p. 3 and 4. Note that no new notice has been generated.
Sponsored-by: Ignatianum University in Cracow
Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
When an error occurred during the DB update the UI is not correct.
1. say_success, say_info, etc. show the span tags and are not colored
2. "Everything went okay" shown even if atomic updates failed
3. The same error can be displayed several time (see https://snipboard.io/IGiKgM.jpg)
Test plan:
Create a new db rev and/or atomic update
Have some say_* statement to render messages, and raise an error
For instance:
say_info( $out, "Use blue for further information" );
try {
say_warning( $out, "Use yellow for warning/a call to action" );
$dbh->do(q{});
} catch {
say_failure( $out, "Use red for danger/failure" );
$_->rethrow;
};
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
To test
1) yarn api:bundle && koha-plack --restart kohadev
2) Enable ILLModule and put some 'ILL staff email:' on some library
3) Access <staff_url>/api/v1/libraries
4) Notice the attribute reads ill_email
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This will make it so if acquisition_source is of an existing vendor_id, it'll show the vendor name instead of the id.
If it's not of an existing vendor_id, show the raw value instead.
I'm not 100% happy with this patch as it adds an edge case to Item::strings_map but I believe the only alternative
is to make 952$e Source of acquisition an AV field in the default framework.
Not only that, but this would have to be an AV field of type 'vendors' that'd have to allow to pick from existing vendors (similar to current 'branches').
The above is a ton more work than initial suggestions would imply.
Happy to be proven wrong (in fact, hoping I am).
This is compatible with main Koha only, not backportable to 23.11
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
1) Apply patch, reset_all
2) Configure holdings_table, visit:
<staff_url>/cgi-bin/koha/admin/columns_settings.pl?module=catalogue&page=detail&table=holdings_table
3) Confirm holdings_booksellerid is there and is hidden by default
4) Visit a record:
<staff_url>/cgi-bin/koha/catalogue/detail.pl?biblionumber=76
5) Edit one of the items and add a value to field 'e' Source of acquisition
5.5) You may need to click the 'show filters' link in order to have the 'Columns' table button show up
6) Go back to the record and click on the 'Columns' above the table
7) Click 'Source of acquisition'. Confirm it shows as expected
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
This patch adds the subscriptions+count option to the embeddable enum
for the /vendors endpoint.
Test plan
1) Inspect the change to t/db_dependant/api/v1/acquisitions_vendors.t
and confirm it's testing for the addition of subscriptions_count.
2) Run the above tests and confirm it passes
Note: For the above tests to pass, you will need to ensure your api
bundle is rebuilt after the patches are applied and restart plack.
`yarn build && restart_all` in ktd
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Martin Stenberg
Artur
David Cook
Magnus Enger
Kyle M Hall
Tomas Cohen Arazi
Phil Ringnalda
Martin Renvoize
Nick Clemens
Jonathan Druart
Pedro Amorim
Jan Kissig
Katrin Fischer
Owen Leonard
Victor Grousset/tuxayo
Emily Lamancusa
Janusz Kaczmarek
