Commit Graph

59139 Commits

Author SHA1 Message Date
Marcel de Rooy f4bb32ff0c
Bug 42254: (QA follow-up) Remove unused var, fixing a FIXME
Test plan:
Read the patch. Look for the var in the script.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-04-28 15:57:07 -06:00
David Cook 5d8f521ae9
Bug 42254: (follow-up) tweaks to improve XSS fix
This change removes useless success_* calls, removes an unnecessary
'use URI::Escape qw( uri_unescape );' in the Perl, adds a missing
response function argument, uses a safe sink for the "verdict" element
to make the content setting a bit cleaner.

Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-04-28 15:57:07 -06:00
Jonathan Druart 4d82aa7a39
Bug 42254: Prevent XSS when testing tags
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-04-28 15:57:06 -06:00
Lucas Gass 4c91dacfaf
Bug 34000: DBRev 25.05.09.001
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-04-28 15:57:06 -06:00
Martin Renvoize d9aa6fd294
Bug 34000: Unit tests
Adds a new subtest to t/db_dependent/Koha/Patron.t covering
fixup_cardnumber and the autoMemberNumValue counter:

- Normal increment bumps the counter
- Renaming a patron's cardnumber does not free it for reuse
- Deleting a patron does not free their cardnumber for reuse
- Counter wins when ahead of db_max
- db_max wins when ahead of counter
- Legacy fallback when the syspref row is absent

Also adds autoMemberNumValue to the exceptions list in
t/db_dependent/check_sysprefs.t. The preference is managed internally
by Koha::Patron::fixup_cardnumber -- it is not user-configurable and
has no entry in the admin preference YAML files.

Test plan:
1. prove t/db_dependent/Koha/Patron.t
2. prove t/db_dependent/check_sysprefs.t
3. prove t/db_dependent/Koha/Plugins/Barcode_transform_hooks.t
   (confirm the patron_barcode_transform hook is still called twice
   during store when autoMemberNum is enabled).

Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
(cherry picked from commit 2091ef0fea)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-04-28 15:57:05 -06:00
Martin Renvoize f1a8e146ac
Bug 34000: Prevent re-issuance of auto-generated cardnumbers
When autoMemberNum is enabled, Koha picks the next cardnumber as
MAX(numeric cardnumber in borrowers) + 1. If patron A's auto-generated
cardnumber is later changed (e.g. they get a physical card) or the
patron is deleted, the original number becomes "free" and the next
self-registrant is assigned it -- inheriting anything third-party
services (OverDrive, Hoopla, unauthenticated self-check) have keyed on
the cardnumber.

This patch makes Koha::Patron::fixup_cardnumber use a monotonic counter
(the autoMemberNumValue syspref) so that once a number has been
auto-generated for any patron, it is never auto-generated again.

The syspref row is locked with SELECT ... FOR UPDATE inside the
existing txn_do, which serialises concurrent callers via InnoDB
row-level locking and addresses the race condition raised against
earlier revisions of this patch.

The formula is: next = MAX(counter, db_max) + 1. When the counter is 0
(pre-upgrade or missing syspref), this degrades gracefully to
db_max + 1 -- the legacy behaviour -- so no feature toggle is needed.
The counter is only bumped when Koha actually auto-generates a
cardnumber; plugin- or caller-supplied values do not touch it.

Test plan:
1. Enable autoMemberNum.
2. Self-register patron A via OPAC, note cardnumber N.
3. Edit patron A in the staff interface, change cardnumber to
   something non-numeric like "MANUAL-XYZ".
4. Self-register patron B.
5. Confirm B gets N+1, NOT N.
6. Delete patron A.
7. Self-register patron C.
8. Confirm C gets N+2, NOT A's original number.
9. Install a plugin implementing the patron_barcode_transform hook;
   confirm it still runs and its value is honoured (counter is not
   bumped when the plugin supplies a cardnumber).

Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
(cherry picked from commit ccfbb35de5)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-04-28 15:57:05 -06:00
Martin Renvoize b55535e770
Bug 34000: Add autoMemberNumValue system preference
Introduces a new system preference, autoMemberNumValue, which tracks
the highest auto-generated cardnumber ever issued. It is seeded from
the MAX cardnumber across both borrowers and deletedborrowers so
pre-upgrade deletions do not free numbers for re-issuance.

This preference is managed internally by Koha::Patron::fixup_cardnumber
and has no UI (no YAML entry).

Test plan:
1. Apply the atomicupdate:
   perl installer/data/mysql/updatedatabase.pl
2. Verify the preference exists:
   SELECT * FROM systempreferences WHERE variable = 'autoMemberNumValue';
3. Confirm the seed value matches:
   SELECT GREATEST(
       COALESCE((SELECT MAX(CAST(cardnumber AS SIGNED)) FROM borrowers
                 WHERE cardnumber REGEXP '^-?[0-9]+\$'), 0),
       COALESCE((SELECT MAX(CAST(cardnumber AS SIGNED)) FROM deletedborrowers
                 WHERE cardnumber REGEXP '^-?[0-9]+\$'), 0)
   );
4. Re-run the atomicupdate and confirm the already-exists warning.
5. Drop the syspref, re-apply the atomicupdate, confirm it seeds
   correctly on fresh installs via mandatory/sysprefs.sql.

Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
(cherry picked from commit aa84e99db8)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-04-28 15:57:04 -06:00
David Cook 09da6e9237
Bug 42253: (QA follow-up) prevent XSS injection in data- attribute
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-04-28 15:57:04 -06:00
Jonathan Druart 13dd809d82
Bug 42253: Prevent XSS in the advanced editor - macros
Test plan:
/cgi-bin/koha/cataloguing/editor.pl
Click "Macros", "New macro..."
Enter <script>alert("booh");</script>
OK
Click on the macro name, run macro, delete macro, mark as public:
Nothing should trigger an alert

QA:
-            $( '#macro-list li[data-name="' + name + '"][data-id="' + id + '"]' ).addClass( 'active' );
+            $( '#macro-list li[data-id="' + id + '"]' ).addClass( 'active' );
Why did we need name and id to select the macro?

Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-04-28 15:57:03 -06:00
Lucas Gass c681a69ac3
Tidy t/db_dependent/Koha/ILL/Requests.t
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-04-22 07:32:36 -06:00
Lucas Gass 74cad3a5cf
Update release notes for 25.05.09 release
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-04-21 17:58:43 -06:00
Lucas Gass b6d2599daa
Increment version for 25.05.09.000 release
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-04-21 17:58:36 -06:00
Jonathan Druart 4d78fc4175
Bug 42048: Add a Cypress test
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-04-21 12:02:53 -06:00
David Cook 8dd51fb212
Bug 42048: Build patron search description more carefully
This patch builds the patron search description more carefully
to avoid XSS

Test plan:
0. Apply the patch
1. Log into Koha and click on "Patrons"
2. Change the "Category" and "Library" to any option but "Any"
   and click "Search"
3. Type "test" into the data table "Search:" box
4. Note some text should appear on the screen similar to this content
   and format:

   Patrons found for: Anywhere: test
   Library=Centerville, Category=Board

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-04-21 12:02:53 -06:00
Jonathan Druart 5f80a6e44d
Bug 41594: [25.05.x] Add Cypress tests
* Add Cypress tests to cover the 404 redirect if the pref is disabled
* Add "invoices" as possible embed option for
  /acquisitions/vendors/:vendor_id
Seems relevant as the api def for invoice if expecting for it
api/v1/swagger/definitions/invoice.yaml
* Tell insertObject how to generate an invoice and return it.
Unfortunately we don't have a direct route for that, hence the embed
on /vendors/:vendor_id

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-04-21 12:02:52 -06:00
David Cook aa8be6ae76
Bug 41594: [25.05.x] Disable access to invoice-files.pl if AcqEnableFiles disabled
This patch makes it so that invoice-files.pl returns 404 if
AcqEnableFiles is disabled

Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Go to /cgi-bin/koha/acqui/invoice-files.pl?invoiceid=999
3. Note that you see a 404 page
4. Change "AcqEnableFiles" syspref to "Do"
5. Go to /cgi-bin/koha/acqui/invoice-files.pl?invoiceid=999
6. Note that you now see a "Files for invoice" page

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-04-21 12:02:52 -06:00
David Cook e66a8bb617
Bug 41261: RMaint patch for 25.05.x-security
This change adds data validation to the "unapi" API endpoint.

Test plan:
0. Apply the patch
1. Go to http://localhost:8080/cgi-bin/koha/unapi
2. Note the 400 HTTP response code
3. Go to http://localhost:8080/cgi-bin/koha/unapi?id=bad
4. Note the 400 HTTP response code
5. Go to http://localhost:8080/cgi-bin/koha/unapi?id=koha:biblionumber:1&format=bad
6. Note the XML response listing the available formats for that ID
7. Go to http://localhost:8080//cgi-bin/koha/unapi?id=koha:biblionumber:1
8. Note the XML response listing the available formats for that ID
9. Go to http://localhost:8080//cgi-bin/koha/unapi?format=mods
10. Note the 400 HTTP response code
11. Go to http://localhost:8080//cgi-bin/koha/unapi?id=koha:biblionumber:1&format=mods
12. Note the MODS format returned for biblionumber 1

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-04-21 12:02:45 -06:00
Laura_Escamilla d72715f010
Bug 36466: Move atomic update to db_revs
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-04-07 11:26:54 -04:00
Hammat Wele 40ae10bed9
Bug 41655: Local OPAC covers are not displayed in OPAC lists
Local cover images are no longer displayed in OPAC lists since Bug 41078.
In Koha versions prior to 25.05.05, local cover images were correctly displayed in OPAC lists.

This appears to be a regression.

To reproduce

1. Set the system preferences LocalCoverImages and OPACLocalCoverImages to Show.

2. Find a bibliographic record and open the record detail page.

3. Upload a local cover image file for the record.

4. Create a public list and add the record to the list.

5. In the OPAC, open the public list.
   --> The local cover image is missing.

6. Apply the patch.

7. Reload the OPAC list page.
   --> The local cover image is now displayed correctly.

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-04-01 16:41:32 -04:00
Marcel de Rooy 2d9c05c4c0
Bug 41449: Reserves.t - fix description and assumption for onshelfholds
Test plan:
prove t/db_dependent/Reserves.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-30 18:02:29 -04:00
Pedro Amorim 004fa61755
Bug 41465: Fix display of 'type' for unauthenticated ILL request
'request' is unblessed in this context. get_type doesnt exist/work.

Test plan:
1) Enable ILLModule and ILLOpacUnauthenticatedRequest
2) Logout, place an OPAC unauthenticated ILL request, visit:
<opac_url>/cgi-bin/koha/opac-illrequests.pl?backend=Standard&op=add_form
3) Input all mandatory fields. Click 'Create'.
4) Notice 'Request type' shows as 'N/A'. This will always be the case regardless of type you pick.
5) Apply patch. Repeat. Notice 'Request type' now shows as expected.

Signed-off-by: Richard Bridgen <richard.bridgen@nhs.net>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-30 18:02:29 -04:00
Pedro Amorim b6247e6891
Bug 41478: Refactor: Readability + Never nester
1) Install the following dummy backend plugin:
https://github.com/openfifth/koha-ill-backend-plugin/releases/tag/v2.0.9
2) Sys prefs preparation: Enable ILLModule, ILLOpacUnauthenticatedRequest and check PluginBackend on AutoILLBackendPriority
3) Logout, create a new Unauthenticated ILL request on the OPAC, visit:
<opac_url>/cgi-bin/koha/opac-illrequests.pl?op=create&backend=Standard
4) Fill in the mandatory top fields (first name, last name, email address and library)
5) Pick 'Book' for type and enter 'green' in title. This will cause the dummy plugin to be available in the AutoILL logic.
6) At the bottom of the form, on the "Verification" captcha, purposely input a wrong captcha e.g. '123'
7) Click 'Create'. Notice an odd looking form is presented, this is the dummy backend form, but it should present the 'Standard' form when using AutoILLBackendPriority as that was also the form we were presented with originally.
This happens because currently it's the backend that delegates back to Koha what template to render. When using AutoILLBackendPriority, however, Koha should handle this template delegation instead and present the Standard form.
8) Apply patches. Repeat test plan. Notice that now on step 7 you get the correct form, and error message (coming from Standard, as expected when using AutoILLBackendPriority).
9) Input the correct captcha this time
10) Confirm the created request landed in the PluginBackend backend.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-30 18:02:29 -04:00
Pedro Amorim 363c7ce18d
Bug 41478: Render Standard form on OPAC if failed_captcha and AutoILLBackendPriority
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-30 18:02:28 -04:00
Pedro Amorim 934c9aef77
Bug 41512: (OPAC) Additional fix
This is needed or else the OPAC still throws the 'malformed query string' mentioned on the original test plan.
This is because the fix from bug 40865 was only applied to intra datatables.js not the OPAC datatables.

I don't know why this fixes it for the OPAC, but it does.

Joubu, thoughts?

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-30 18:02:28 -04:00
Pedro Amorim 352c56cb35
Bug 41512: Fix ILLCheckAvailability
1) Install the unpaywall plugin:
  https://github.com/openfifth/koha-plugin-ill-avail-unpaywall/releases/tag/1.0.2
2) Configure an email address on the plugin configuration (I believe any email address should work):
<staff_url>/cgi-bin/koha/plugins/run.pl?class=Koha%3A%3APlugin%3A%3ACom%3A%3APTFSEurope%3A%3AAvailabilityUnpaywall&method=configure
3) Enable ILLModule and ILLCheckAvailability sys prefs
4) Create a new ILL request, visit:
  <staff_url>/cgi-bin/koha/ill/ill-requests.pl?method=create&backend=Standard
5) Pick type: journal article and enter the DOI: 10.1002/bjs.1800621024
6) Enter a cardnumber e.g. '42' for koha user and any library.
7) Notice the availability screen never renders, a console error is logged on the browser.
8) Apply patch. Refresh. Repeat.

This appears to have stopped working after bug 26553. Using git bisect, after bug 26553 (cc09868152), this started returning a 'bad request: malformed query string' because query params were being sent to the plugin API route (which doesn't consider them). Bug 40865 then fixed the bad request error, but resulted in the console error we see now, which is fixed by this patch.
ajax.dataSrc appears to now be returning an additional level of 'data' due to datatables upgrade (?), this patch changes the dataSrc override to be more in line with the example doc at https://datatables.net/reference/option/ajax.dataSrc

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-30 18:02:28 -04:00
Marcel de Rooy 6fb28b5583
Bug 19690: Change comments in IsAvailableForItemLevelRequest
The term 'If any unavailable' is not very clear but it is also
very hard to find something short and better.

A next available hold is possible when at least one item is
unavailable (checked out, on order, waiting/transit hold).
A item level hold is possible when the specific item is
unavailable.

Test plan:
Read the patch. The code did not change.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-30 18:02:28 -04:00
David Cook bb51a3b2a1
Bug 34879: Remove unused file from Koha
This change removes the "catalogue/getitem-ajax.pl"
which appears to be an unused file in Koha.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-30 18:02:28 -04:00
Hammat Wele 9cefb5f4ca
Bug 36466: (follow-up) Use NULL for blank planned and published dates instead of today
Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-30 18:02:28 -04:00
Hammat Wele 0a8c308b2c
Bug 36466: (follow-up) Adding atomicupdate file to fix 0000-00-00 in serial table
WNC amended patch - tidied

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Emmi Takkinen <emmi.takkinen@koha-suomi.fi>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-30 18:02:27 -04:00
Hammat Wele ed11deb1a6
Bug 36466: Incorrect date value stored when 'Published on' or 'Expected on' are empty
When we edit a serial and we leave the date fields ('Published on' or 'Expected on') empty incorrect date are saved in the database 0000-00-00
instade of current date and we get Error 500

to reproduce
1. Connect to staff interface
2. Go to Serials and create a new subscription
3. Click on Serial collection in the left menu (and note the
   Subscription numnber)
4. Select a serial to edit and Click on «Edit serials»
5. In the Serial edition form, delete «Published on > and « Expected on
   » dates and save
    ----> Error 500 page is displayed
6. Check the value of «Published on > and « Expected on » dates  in the
   database
   select planneddate,publisheddate from serial where subscriptionid=<Subscription numnber in step 3>;
    ------> planneddate publisheddate have «0000-00-00» value
7. Apply the patch
8. run ./installer/data/mysql/updatedatabase.pl
9. repeat step 2, 3, 4, 5, 6
   ----->  Error 500 page is no more displayed
   -----> «Published on » and « Expected on » field have NULL as value

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-30 18:02:27 -04:00
Baptiste 505e58d1d2
Bug 40960: Print notification only if selected type is impossible
Test plan (ktd):
1 - Have henry acevedo have no mail and set messaging preference "Hold filled to sms"
2 - Have edna acosta have not messaging preference
3 - Place an hold on two books for edna acosta and henry acevedo, check in both books and select the button to fill the hold
4 - Check in notices and see that both received a notice
5 - Apply tests and run tests -> they should fail
6 - Apply patch, run rest -> they should pass
7 - Unfill both holds and fill them back. Henry should keep receiving notices while Edna should not anymore.

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-30 18:02:27 -04:00
Baptiste 24b7f4eacb
Bug 40960: Fix unit tests
Two unit tests have been moved/replaced to fit the desired behaviour

- "patron notified when item set to waiting" -> does not fit the desired behaviour.
  The desired behaviour for mails/sms is already tested
  The desired behaviour for prints is changed to "patron not notified if
  no messaging preference is specified"
- "patron not notified a second time (bug 11445)" -> Moved into
  _koha_notify_reserve tests

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-30 18:02:27 -04:00
Lucas Gass ba6d2d29f0
Bug 41422: Fix I18N issue with FilterSearchResultsByLoggedInBranch
To test:
1. Apply patch
2. Search fof the FilterSearchResultsByLoggedInBranch system preference and set it to 'Do'.
3. Do a catalog search and notice the 'Show local items only' button above the "Location" column.
4. Click it to show information ( in that column ) that is only related to the branch you are currently logged in at.
5. In the same result set have some items that are checked out, withdrawn, lost, damaged, and notforlaon.
6. Play more with the search results and ensure everything is accurate.
7. Set the FilterSearchResultsByLoggedInBranch system preference to 'Don't' and confirm that there is no button to filter by branch anymore.

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-30 18:02:27 -04:00
Emmi Takkinen 57dc4c7c20
Bug 41431: Use correct data-attribute to fetch existing circulation rule note
If you click Edit on a line with a note, the note field is not displayed
in the editing line and is blanked upon save (i.e., the note is lost,
even if you made no edits on the note). Value of the note is stored to
data-attribute which was changed to use Bootstraps own data-attribute.
So now the value must be fetched with keyword "bsContent" instead of
just "content".

To test:
1. Add note for a circulation rule.
2. Edit the rule.
=> Note that notes value is not displayed in editing row.
3. Apply this patch.
4. Edit rule again.
=> Note that notes value is now displayed as expected.

Sponsored-by: Koha-Suomi Oy
Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-30 18:02:26 -04:00
Lucas Gass aee23d1eb7
Bug 41475: Make hostitemnumbers an array ref
To test:

1. Set 'EasyAnalyticalRecords' to 'Show'.
2. Find or create a parent record that has at least 2 items on it. Note the itemnumbers and the framework.
3. Edit that framework so you can add a 773$0, 773$9, and 773$t
4. Find or create a child record.
5. Make at least 2 773 entries on the child record. Add the biblionumber of the host record to the 773$0.
6. In each entry for the 773$9 add one of the itemnumbers from the host record.
7. For the 773$t and the biblio title of the host record.
8. Save.
9. Now attempt to put a hold on the child record.
10. 500 error:
11. APPLY PATCH and restart_all
12. Try placing the hold again, this time it succeeds.

Signed-off-by: Emmi Takkinen <emmi.takkinen@koha-suomi.fi>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-30 18:02:26 -04:00
Tomás Cohen Arazi 7bc586a902
Bug 41617: Remove extra spaces breaking CSV formatting
This patch removes extra spaces breaking CSV parsing in tools like Excel.

To test:
1. Perform an item search selecting the CSV option
2. Open the CSV with a TEXT EDITOR of your choice
=> FAIL: Notice the extra spaces after the commas (those used as separators, no the ones within the double quotes)
3. Apply this patch
4. Repeat 1-2
=> SUCCESS: No extra spaces!
5. Sign off :-D

Note: On the first attempt you can open the file on Excel if you have it and notice things are not aligned.
Note2: Using double quotes on all fields regardless of the context works for most parsers, but is not correct CSV. Will deal with it on a separate bug.

Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-30 18:02:26 -04:00
Ayoub Glizi-Vicioso 0317f6b286
Bug 41689: Make patron message labels translatable
To Test:

BEFORE APPLYING PATCH:
1- Go to any patron account > Add message
2- Add a message for: "Staff - Internal note"
3- Add a second message for: "OPAC - [NAME OF THE PATRON SELECTED]"

4- Add any language (I'll use french-Canada, fr-CA, in this case):
From your koha instance, enter on the command line:
./misc/translator/translate install fr-CA

5- Go to Administration > System preferences > enter language
6- Make sure to check 'Français (fr-CA)' box from the 'StaffInterfaceLanguages'preference and save.

7- Go back to the specific patron in which you added the messages
8- Switch language to 'Français' (bottom left corner)

9- Notice that:
--> 'OPAC' is still the same (Since we spell OPAC the same way in both english and french. However, it might not be the case in other languages).
--> 'Staff note' is not translated.

10- apply patch

AFTER APPLYING PATCH:

11 - From you koha instance, enter on the command line:

./misc/translator/translate update fr-CA

./misc/translator/translate install fr-CA

12- Reload patron's page

13- Notice that 'Staff note' is now translated
** You should see this output: 'Note interne'

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-30 18:02:26 -04:00
Andrew Fuerste Henry 7745ff9456
Bug 41752: label concactfirstname and contactname as Guarantor first name and Guarantor surname
This change impacts the display of patron fields listed in system preferences:
BorrowerMandatoryField
BorrowerUnwantedField
PatronSelfModificationBorrowerUnwantedField
PatronSelfRegistrationBorrowerMandatoryField
PatronSelfRegistrationBorrowerUnwantedField

To test:
1 - confirm that the sysprefs listed above include "Alternate contact: First name (contactfirstname)" and "Alternate contact: Surname (contactname)"
2 - confirm that toggling the display of these fields hides/shows the Guarantor first name and Guarantor surname fields in a patron record
3 - apply patch, restart_all
4 - confirm that sysprefs now show "Guarantor first name (contactfirstname)" and "Guarnator surname (contactname)"
5 - confirm toggling the display of these fields still hides/shows the correct fields in a patron record in the staff client, in self-ref, and in OPAC self-modification

Signed-off-by: Anneli Österman <anneli.osterman@koha-suomi.fi>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-30 18:02:26 -04:00
Owen Leonard 6041a1ddc5
Bug 41764: ISSN hidden input missing from Z39.50 search form navigation
This patch modifies the Acquisitions and Cataloging Z39.50 search forms
so that the pagination form includes a hidden ISSN input. This is
necessary for the form to submit the same search parameters each time
the user requests a new page of results.

To test, apply the patch and go to Acquisitions.

- Search for a vendor, and create a basket if necessary.
- Add to the basket and choose "From an external source."
- In the "ISSN" field, enter a partial ISSN number, e.g. 0361, and
  search.
- At the bottom of the search results, click the "Next page" button.
- The second page of results should load correctly. At the top of the
  table of results it should say "You searched for: ISSN: 0361"
- Perform the same test in Cataloging:
  - Cataloging -> New from Z39.50/SRU

Sponsored-by: Athens County Public Libraries
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-30 18:02:26 -04:00
Owen Leonard b1fdee831e
Bug 41040: (follow-up) Move JS to global JS file
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-30 18:02:25 -04:00
Owen Leonard 5477c637d0
Bug 41040: (follow-up) Tooltip text change and remove unnecessary class
- I think "Please enter a card number or name" sounds friendlier
- We don't add a "btn-primary" class to these buttons

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-30 18:02:25 -04:00
Kyle M Hall 0fc19fe00f
Bug 41040: Use tooltip for message instead of alert
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-30 18:02:25 -04:00
Kyle M Hall 141de66416
Bug 41040: Prevent form submission if no filters have been selected
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-30 18:02:25 -04:00
Kyle M Hall 0f504feede
Bug 41040: Empty patron search from the header should not trigger a patron search
If the "arrow" button on the patron search is clicked with no value in
the textbox, it redirects to members/members-home.pl and performs a
search with no value automatically. It makes more send for it to behave
as the "Patrons" link in the navbar that directs to members-home.pl
where the librarian can then perform a more advanced search.

Test Plan:
1) Click the "Search patrons" link on the header, then the arrow button
2) Note an empty patron search is performed immediately
3) Apply this patch
4) Restart all the things!
5) Repeat step 1
6) Note a paton search is no longer triggered automatically

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-30 18:02:25 -04:00
Slava Shishkin 3183fd17d8
Bug 41055: add missing accesskey attribute for print button
This commit adds the missing accesskey attribute to the print button in the circulation template.

Test plan:
1. Try to checkout an item that is waiting for pickup.
2. Try to print the checkout receipt using the alt+shift+p keyboard shortcut.
3. Verify that nothing happens when using the shortcut.
4. After applying this commit, try the same steps again.
5. Verify that the print button now works with the alt+shift+p keyboard shortcut.

Sponsored-by: Koha-Suomi Oy

Signed-off-by: Slava Shishkin <slavashishkin@gmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-30 18:02:25 -04:00
Baptiste Wojtkowski 92353e5294
Bug 41420: Fix referrer in parcel.tt
Test plan:

Steps to reproduce :
1 - Go to http://localhost:8081/cgi-bin/koha/acqui/neworderempty.pl?booksellerid=1&basketno=1 and fill in a new item.
2 - Visit http://localhost:8081/cgi-bin/koha/acqui/parcels.pl?booksellerid=1, type an invoice name and validate. Inspect both "Cancel order" and "Cancel order and catalog record". Notice the link in "Cancel order is broken"
3 - Apply patch
4 - Repeat 3 and notice the referrer is well formed.

For a reason I ignore, it does not seem to have an impact on main, but
on the 24.11 I tested, if you click on cancel order, after confirming
the deletion and clicking on "ok", you will be asked again to confirm,
    however the deletion has been performed

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-30 18:02:24 -04:00
Slava Shishkin d58291a992
Bug 41458: Pass a valid GID to Net::Server for SIP
When starting SIP, Koha passes an incorrect value to the
Net::Server "group" parameter, which can generate an
error in the logs":
  Couldn't become gid "<uid>": Operation not permitted

This change ensures that a valid numeric GID is passed instead.

Test plan:
1. Enter KTD shell.
2. To reproduce the error: sudo groupmod -g 8001 kohadev-koha
3. Restart SIP: sudo koha-sip --restart kohadev
4. Check SIP logs:
     /var/log/koha/kohadev/sip-output.log
5. Observe the error:
     Couldn't become gid "<uid>": Operation not permitted
6. Apply this patch.
7. Repeat steps 2 to 4.
8. Verify that the "Couldn't become gid" error is no longer logged.

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-30 18:02:24 -04:00
Andrew Fuerste Henry bc16d0ad56
Bug 41588: Normalize spaces in 856$u links
To test:
1 - add 856$u " www.cheese.com" to a record
2 - confirm link does not work from results or details in either staff interface or OPAC
3 - add 856$u "www.cheese.com " to a record
4 - confirm link does not work from results or details in either staff interface or OPAC
7 - apply patch, restart_all
8 - reload pages, confirm both links work in results and details in staff interface and OPAC

Optional final step: have some cheese as a treat

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Jan Kissig <bibliothek@th-wildau.de>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-30 18:02:24 -04:00
Martin Renvoize bbcb45ddc4
Bug 41679: Fix overlapping modals when hold conflicts with stock rotation transfer
When checking in an item that has both a hold and a stock rotation
repatriation transfer, both modals would appear simultaneously,
overlapping each other and making it impossible to interact with
either one properly.

This occurred because:
1. The hold modal showed when 'waiting' was set
2. The transfer modal condition checked for 'reserved' but not 'waiting'
3. Both modals had the "block" class, causing simultaneous display

This patch ensures holds take precedence over stock rotation transfers
by adding a check for the 'waiting' flag to the transfer modal condition.

When a hold is found, only the hold modal displays. The stock rotation
transfer can be handled at a subsequent check-in, which is appropriate
since holds are patron-facing and time-sensitive, while stock rotation
is an internal process that can be deferred.

Test plan:
1. Enable StockRotation system preference
2. Navigate to Cataloging->Stock rotation
3. Click '+ New rota' and fill out with any values
4. Click 'Manage->stages' for the Rota
5. Add a stage for Centerville for 1 day, and Midway for 1 day
6. Return to rotas
7. Click Manage->items for the rota
8. Add an item
9. Return to rotas
10. Click 'Activate'
11. On the command line run the stock rotation job:
    perl misc/cronjobs/stockrotation.pl -x
12. There should be one item for initiation
13. Run it again, there should be one stationary item
14. Place an item specific hold for the item, for pickup at Midway
15. Check the item in at Centerville, confirm transfer
16. Check the item in at Midway, confirm hold
17. Run the stock rotation job again:
    perl misc/cronjobs/stockrotation.pl -x
18. There should be one item for repatriation
19. Check in the item again at Midway
20. Before patch: Two overlapping modals appear (hold + transfer)
21. After patch: Only the hold modal appears
22. Confirm the hold - no transfer modal should appear
23. The stock rotation transfer will be handled at the next check-in

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-30 18:02:23 -04:00
Laura_Escamilla 153eb9f50e
Revert "Bug 40995: Use patron_to_html in patron autocomplete"
This reverts commit 775cc4c980.

Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-03-17 14:53:49 -04:00