Add the 26.11 release team as voted at the development meeting.
Pedro Amorim as Release Manager, with Tomás Cohen Arazi and Martin
Renvoize as RM Assistants. Lisette Scheer as QA Manager with a
19-person QA team. David Cook as Security Release Manager.
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
The angle-bracket delimiter notation in the POD prose (e.g.
PATTERN<DELIM>) caused the POD parser to treat the trailing letter of
each word as an unknown formatting code (N<>, T<>). Replace with
C<s/PATTERN/REPLACEMENT/FLAGS> and a parenthetical note that any
non-space delimiter is accepted.
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
- t/C4/ClassSplitRoutine/RegEx.t (new): exercises _apply_substitution via
the public split_callnumber interface — basic substitution, alternate
delimiters, \n/$n backrefs, /gi combined flag, /e rejection, and malformed
or uncompilable rules (including the new logger warn path).
- t/Koha/Regex/Replacement.t: extend the subst() helper to handle the ig/gi
combined modifier and add a subtest that confirms case-insensitive global
replacement and backref case preservation.
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
When eval { qr/$pattern/ } fails (e.g. the admin-configured s/// contains
an invalid regex), _apply_substitution previously returned silently with no
indication of why the rule was skipped. Add a Koha::Logger warn so the
failure appears in the log and is diagnosable without a debugger.
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Note: While the methodology in Koha::Regex::Replacement may seem
bespoke, it's similar to how Python's re.sub(pattern, repl, string)
regex substitution works.
Unit tests:
prove -v t/Koha/Regex/Replacement.t \
t/SimpleMARC.t \
t/db_dependent/MarcModificationTemplates.t \
t/Labels_split_Regex.t
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
C4::ClassSplitRoutine::RegEx::split_callnumber ran the admin-configured rule
through eval "\$cn_item =~ $regex", executing arbitrary Perl. Parse the
rule as s<DELIM>PATTERN<DELIM>REPLACEMENT<DELIM>FLAGS, reject the /e flag,
compile the pattern with qr// and expand the replacement as data via
Koha::Regex::Replacement::expand_template, so the rule is applied without
eval.
Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Koha::SimpleMARC::_modify_values and Koha::Items::apply_regex wrapped the
user replacement in a string and ran it through s///ee, so an interpolation
block such as \@{[ system(...) ]} executed arbitrary Perl. Expand the
replacement as data via Koha::Regex::Replacement::expand_template under a
single /e instead, which keeps capture-group replacements working but never
runs the input as code.
Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Add a small single-pass helper, Koha::Regex::Replacement::expand_template,
that expands a user-supplied regex replacement string as data: numbered
backreferences ($1..$n, ${n}, the legacy \1..\9 form), named captures
($+{name}, ${name}) and the \n \r \t escapes. Every other character is
copied through literally, so \@{...}/${...} interpolation blocks end up as
text rather than being run. This is used to replace the s///ee double-eval.
The routine is fully qualified at the call sites rather than exported, and
case folding is left out to keep it small.
Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
The original fix only whitelisted agefield, condition_field, and
substitution_field at the point they're saved in
tools/automatic_item_modification_by_age.pl, leaving the actual
consumer of the stored syspref, C4::Items::ToggleNewStatus, trusting
agefield and substitution field unchecked. agefield is spliced
directly into raw SQL (TO_DAYS($agefield)) and so can't be
parameterized like an ordinary value; substitution field reaches a
dynamic method call ($item->$field($value)). Any future or
alternate writer of the automatic_item_modification_by_age_configuration
syspref would have reopened both holes without touching the form at
all.
This adds the same allow-list validation directly in ToggleNewStatus
(falling back to the safe default agefield, or skipping the
substitution/condition, exactly as before for missing values), shares
the age-field allow-list between the two files via a new
GetAutomaticItemModificationAgeFields() in C4::Items so it can't drift
between them, and logs rejected values via Koha::Logger instead of
silently discarding them so tampering leaves an audit trail.
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Amended-by: Jonathan Druart:
Replace , with ;
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
(cherry picked from commit 3b53d6711d)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
(cherry picked from commit 5cf846f9f8)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
The original fix only whitelisted image_name at the point it's saved
in edit-layout.pl, leaving the actual injection sink in create-pdf.pl
unparameterized. This adds defense-in-depth by fixing the query itself,
avoids a redundant duplicate call to get_all_image_names() (already
fetched earlier in the script as $image_names), and logs rejected
image_name values instead of silently discarding them so tampering
attempts leave an audit trail.
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
(cherry picked from commit 5b825da072)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
(cherry picked from commit dc4403aae0)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
(cherry picked from commit c5968932fc)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Ensure no regressions are introduced, run:
prove t/db_dependent/Koha/AdditionalContents.t
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
(cherry picked from commit cb22264499)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
To test:
1. Create two patron accounts:
* One patron whose home library matches the library assigned to the page.
* One patron whose home library is different from the library assigned to the page.
2. Create a new page with the following settings:
* Display location = OPAC
* Library = a specific library
* Publication date = Today
* Title and Content = minimally necessary content
3. Save the page.
4. Right-click the OPAC link and copy the link address.
5. Open the link in an incognito or private browser window without signing in.
* Confirm that the library-specific page is not displayed.
* Confirm that a 404 page is shown.
6. In the incognito window, sign in using the patron account whose home library matches the page library.
7. Open the copied OPAC link again.
* Confirm that the page is displayed.
8. Sign out and sign in using the patron account whose home library does not match the page library.
9. Open the copied OPAC link again.
* Confirm that the page is not displayed.
* Confirm that a 404 page is shown.
10. Edit the page and change Library to All libraries.
11. Open the OPAC link in an incognito or private browser window without signing in.
* Confirm that the page is displayed.
12. While signed in as each patron account, open the OPAC link again.
* Confirm that the page is displayed for patrons from both libraries.
13. Create or edit a page with the following settings:
* Display location = Staff interface
* Library = a specific library
* Publication date = Today
* Title and Content = minimally necessary content
14. Sign in to the staff interface using a staff account whose library matches the page library.
15. Open the page from the staff interface.
* Confirm that the page is displayed.
16. Sign out and sign in using a staff account whose library does not match the page library.
17. Open the staff page link directly.
* Confirm that the page is not displayed.
* Confirm that a 404 page is shown.
18. Edit the staff page and change Library to All libraries.
19. Open the page while signed in with staff accounts from both libraries.
* Confirm that the page is displayed for both accounts.
20. Repeat the OPAC and staff interface checks using Display location = Staff interface and OPAC.
* Confirm that the page is displayed in both interfaces for users from the matching library.
* Confirm that users from a different library receive a 404 page.
* Confirm that pages assigned to All libraries are available in both interfaces.
Signed-off-by: David Cook <dcook@prosentient.com.au>
(cherry picked from commit 2dff8abf7f)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
This change fixes the branch comparison between the Page
and the user. Previously, it was doing a numeric "!=" and now it
does the string comparison "ne". Also, if no environmental variable
is set for the default branch, it defaults to an empty string
for anonymous (ie non-authenticated) users.
Test plan:
0. Apply the patch
1. restart_all
2. Log into the staff interface
3. Go to Tools
4. Click on "Pages"
5. Create a Page for All Libraries for the OPAC
6. Copy the "OPAC" link in the "Page URL" table cell and open it
in a private window or a separate browser
7. Note that the page appears
8. Now change the "Page" to a specific library
9. Revisit the URL in the private window
10. Note that it now gives a 404 error
11. Log into the OPAC with a user whose library matches the libary
of the Page
12. Note that now you can view the URL again
13. Change the library of the user or the Page
14. Note that you cannot see the Page now
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 16df1a33b2)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
To test:
1 - Attempt to save a report containing "select force_password_reset_when_set_by_staff from categories"
2 - observe koha prevents this save
3 - apply patch, restart services
4 - repeat step 1
5 - observe your report now saves and runs successfully
While adding this new field to the list of allowed fields, I changed "whitelist" to "allowlist" as suggested by the terminology guide: https://wiki.koha-community.org/wiki/Terminology
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit fdc57489a1)
Signed-off-by: Jacob O'Mara <jacob.omara@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit be019f4f92)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
- Guard against undefined itemtype before calling ->bookable on it
- Return 0 (not bookable) when no itemtype is found and item-level
bookable is not defined
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
(cherry picked from commit 99410bc27c)
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 327cb59546)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
- Add test case for the scenario where an item has no itemtype
because both items.itype and biblioitems.itemtype are NULL
- Note: We must set biblioitems.itemtype to NULL before creating the
item because Koha::Item->store() automatically populates itype from
biblioitems.itemtype when itype is not set
Test plan:
- Apply this patch only
- Run: prove t/db_dependent/Koha/Item.t :: effective_bookable
- Verify test 6 FAILS with "Can't call method 'bookable' on an
undefined value"
- Apply the follow-up patch
- Run the test again
- Verify all tests PASS
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
(cherry picked from commit 26ffc16c38)
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 00457f7e73)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
When either the <listen id=biblioserver> entry or the
<server id=biblioserver listenref=biblioserver> section
is not present in koha-conf.xml, the Staff interface > About page
triggers a 500 Internal Server Error.
Test plan:
1. Edit koha-conf.xml and Comment out:
<!--<listen id="biblioserver">unix:/path/to/zebradb/bibliosocket</listen>-->
2. Restart Apache: sudo systemctl restart apache2 (or restart_all)
3. Go to Intranet > About
==> Internal Server Error (500)
4. Now restore the <listen> line and instead comment out the entire
<server id=biblioserver listenref=biblioserver>...</server> block.
(Note that the commenting around <!-- The stuff below is used to enable SRU...
interferes with adding a closing comment after </server> -
close the comment before that section and add a comment around </server>.)
5. Repeat step 2, 3
==> Internal Server Error (500)
6. Apply the patch
7. Repeat step 2, 3
==> There is no Error (500)
Note: Zebra status: Error message from Zebra: 10004
8. Uncomment <server id=biblioserver listenref=biblioserver> </server>
and Repeat Step 1
9. Repeat step 2, 3
==> There is no Error (500)
Note: Zebra status: Zebra server seems not to be available. Is it started?
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 03fc6994a5)
Signed-off-by: Chloé Zermatten <chloe.zermatten@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 1b837562b2)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
When creating a new Koha instance using the two-step workflow
(`koha-create --request-db <instance>`, followed by
`koha-create --populate-db <instance>`), some log files under
/var/log/koha/<instance>/ end up with incorrect ownership.
Specifically, intranet-error.log and opac-error.log are owned
by root:root instead of <instance>-koha:<instance>-koha.
This patch fixes that.
Test plan (tailored for KTD):
1) Before applying this patch, run the following commands
inside your KTD Koha container:
$ sudo koha-create --request-db test1
$ SQLPASS=`sudo grep password: test1-db-request.txt | cut -c 16-`
$ mysql -hdb -uroot -ppassword -e "CREATE DATABASE koha_test1;"
$ mysql -hdb -uroot -ppassword -e "GRANT ALL PRIVILEGES ON koha_test1.* TO 'koha_test1'@'%' IDENTIFIED BY '${SQLPASS}';"
$ mysql -hdb -uroot -ppassword -e "FLUSH PRIVILEGES;"
$ sudo koha-create --populate-db test1
$ ls -l /var/log/koha/test1/
total 8
-rw-r--r-- 1 test1-koha test1-koha 0 Feb 9 15:35 indexer-error.log
-rw-r--r-- 1 test1-koha test1-koha 1278 Feb 9 15:35 indexer-output.log
-rw-r--r-- 1 root root 0 Feb 9 15:35 intranet-error.log
-rw-r--r-- 1 root root 0 Feb 9 15:35 opac-error.log
-rw-r--r-- 1 test1-koha test1-koha 0 Feb 9 15:35 worker-error.log
-rw-r--r-- 1 test1-koha test1-koha 1828 Feb 9 15:35 worker-output.log
-rw-r--r-- 1 test1-koha test1-koha 0 Feb 9 15:35 zebra-error.log
-rw-r--r-- 1 test1-koha test1-koha 0 Feb 9 15:35 zebra-output.log
Notice the incorrect user/group ownership on two
files: `intranet-error.log` and `opac-error.log`.
2) Apply this patch, remove the `test1` instance along
with the database request text file, and copy the
modified script to its system-wide location:
$ sudo koha-remove test1
$ sudo rm test1-db-request.txt
$ sudo cp debian/scripts/koha-create /usr/sbin/koha-create
3) Repeat the commands in Step 1. This time, the output of
the last command should resemble the following:
total 8
-rw-r--r-- 1 test1-koha test1-koha 0 Feb 9 15:42 indexer-error.log
-rw-r--r-- 1 test1-koha test1-koha 1520 Feb 9 15:42 indexer-output.log
-rw-r--r-- 1 test1-koha test1-koha 0 Feb 9 15:42 intranet-error.log
-rw-r--r-- 1 test1-koha test1-koha 0 Feb 9 15:42 opac-error.log
-rw-r--r-- 1 test1-koha test1-koha 0 Feb 9 15:42 worker-error.log
-rw-r--r-- 1 test1-koha test1-koha 1828 Feb 9 15:42 worker-output.log
-rw-r--r-- 1 test1-koha test1-koha 0 Feb 9 15:42 zebra-error.log
-rw-r--r-- 1 test1-koha test1-koha 0 Feb 9 15:42 zebra-output.log
All files should now have the correct user/group ownership.
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Jan Kissig <bibliothek@th-wildau.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 7ee861e256)
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit a45a642f35)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
If no orders exist yet, there is a JS error in the console:
Uncaught TypeError: can't access property "DataTable", table is
undefined
Test plan:
0. Do no apply this patch
1. Create a new subscription and go to the detail view
2. Open the console and notice the JS error
3. Apply this patch
4. Confirm that the JS error is gone
5. Create an order from this subscription
6. Confirm that the orders table is displayed
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit da121583a4)
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit da718a2a57)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
If PatronSelfRegistration we should ignore (i.e. do nothing) if
--del-exp-selfreg is passed to cleanup_database.pl
It prevents the script to warn that the pref is not set.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
(cherry picked from commit d331c7aba8)
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 768f2a4882)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This patch updates cpanfile to reflect the real minimum version
needed for MARC::File::XML. This is particularly important
due to vulnerabilities in version 1.0.1
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: mason james <mtj@kohaaloha.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 00655de4d0)
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 8943833fb1)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
The "Cite" option in the OPAC is missing the subtitle (245) in MARC21.
To recreate:
1. Add a record or find a record with a subtitle (in KTD, biblionumber 58 has a 245 http://localhost:8081/cgi-bin/koha/catalogue/MARCdetail.pl?biblionumber=58
2. In the OPAC, go to the record
http://localhost:8080/cgi-bin/koha/opac-detail.pl?biblionumber=58
3. Click "Cite"
--> The subtitle is not in any of the citations
4. Apply the patch
5. Repeat step 2 and 3
--> The subtitle is now shown
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 412e4e4d95)
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit ea6fd886a0)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
To test:
1- have a MARC record with Type of Material "BKS - Books" that does not have an 006 defined (biblio 1 in the KTD default data will work)
2- edit the biblio in the basic editor
3- open the tag editor for the 006
4- observe that the values along the top of the tag editor window show a value of "" (blank) in position 17
5- click Save in the tag editor window
6- confirm that the values in the 006 tag end with a space
7- open the 006 tag editor again
8- observe that the values along the top of the tag editor window no longer show any value for position 17. Instead, they end with the zero in position 16
9- click Save in the tag editor window
10- confirm that the values in the 006 tag now end with a zero, not followed by a space
11- save your biblio
12- edit the biblio in the basic editor again, get warning "The following fixed-length control field(s) have an invalid length: 006. Please fix."
13- APPLY PATCH and restart_all
14. Try editing the 006 value again, the whitespace should be preserved and you get no error.
Signed-off-by: Justin Swink <Justin.Swink@littleelm.gov>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 1a0501f5e8)
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit f26f323aee)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
To test:
1. Make some fields for OPAC self registration required.
2. Create a new patron via self reg.
3. Fill out those required fields as an empty string like " ".
4. Submit the form, it succeeds.
5. APPLY PATCH, restart_all
6. Try again. Required fields with only whitespace are treated as if they were empty.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
(cherry picked from commit 12426b5924)
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 01df1563bf)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
To test:
- Go to Circulation > Bookings to collect
- Click Help
- Verify it links to the correct manual section
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit f53159bfa4)
Signed-off-by: Jacob O'Mara <jacob.omara@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit d6f529c38c)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
The indexation step has been removed by
commit d2820f57d6
Bug 34788: (QA follow-up)
Koha/ERM/EHoldings/Title.pm
- C4::Biblio::ModBiblio( $record, $self->biblio_id, '' );
+ C4::Biblio::ModBiblio( $record, $self->biblio_id, '', { skip_record_index => 1 } );
From the commit message:
2) The background job now uses skip_record_index to avoid queuing indexing jobs for every new biblio and instead queues one job at the end
it's then missing when we add or edit a local title.
Test plan:
1 - Enable ERMModule
2 - Go to ERM
3 - eHoldings->Titles
4 - New title
5 - Populate the form
6 - Check the create bibliographic record box
7 - Save
=> Confirm that the biblio is now indexed
8. Edit the title, modify a value, tick the box, save
=> Confirm that the biblio is now indexed with the new value
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 5dcec8b803)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 1dac2edcf6)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Testing plan:
- Set EmailPurchaseSuggestions to BranchEmailAddress
- Go to create suggestion on the staff side /suggestion/suggestion.pl?op=add_form
- Create a suggestion with Library: Any
- 500 error: inbound_email_address is not a method of undef
- Apply patch & repeat
- Suggestion created
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 33a8dc5d6f)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit f699bb4c50)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Add the 26.11 release team as voted at the development meeting.
Pedro Amorim as Release Manager, with Tomás Cohen Arazi and Martin
Renvoize as RM Assistants. Lisette Scheer as QA Manager with a
19-person QA team. David Cook as Security Release Manager.
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit f0bb03d6e9)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit bbff807136)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Update the 25.11 QA team to reflect the definitive list from the
dashboard. Remove Aleisha Amohia and Julian Maurice who did not
appear in the final count, and add John Vinke, Matt Blenkinsop,
Alex Carver and Victor Grousset who did. Reorder by descending
QA count.
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 5d12a83751)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
This change fixes an SQL injection in the circulation stats.
Test plan:
0. Apply the patch
1. sudo koha-plack --restart kohadev
2. Go to /cgi-bin/koha/reports/issues_stats.pl
3. Try out a bunch of options
4. Try to break it
5. Note that you just get output and no errors
Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
(cherry picked from commit da14a2f672330d445b442cd057bd72688bfb0c37)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This change fixes SQL injection in bor issues top
Test plan:
0. Apply patch
1. sudo koha-plack --restart kohadev
2. Go to /cgi-bin/koha/reports/bor_issues_top.pl
3. Try out all the different options
4. Try to break it
5. Note that you get output and no errors
Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 0d1efd812b9d1d6ac8fe71b7115f5368b8ba271f)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This change fixes SQL injection in issues avg stats
Test plan:
0. Apply the patch
1. sudo koha-plack --restart kohadev
2. Go to /cgi-bin/koha/reports/issues_avg_stats.pl
3. Try out all the different options
4. Try to break the report
5. Note that you always get output instead of errors
Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
(cherry picked from commit f0d3bf850b8ff85c9393126763b1477d1cdc5c09)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This change cixes an SQL injection in cat stats
Test plan:
0. Apply patch
1. sudo koha-plack --restart kohadev
2. Go to /cgi-bin/koha/reports/catalogue_stats.pl
3. Try out different values
4. Try to break the report
5. Note that you just get output and not errors
Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
(cherry picked from commit a9f741b79d231d81e7cdaef2201b8c00c9efe349)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Baptiste Wojtkowski
Martin Renvoize
David Cook
Kyle M Hall
Sanjar Tulkinov Anvar o'g'li
Jonathan Druart
Pedro Amorim
Laura_Escamilla
Andrew Fuerste Henry
Paul Derscheid
Hammat Wele
Andreas Roussos
Lucas Gass
Eric Phetteplace
Fridolin Somers