Commit Graph

26014 Commits

Author SHA1 Message Date
Tomas Cohen Arazi f7b6770ef1 Bug 17788: (MARC21) Add $9 fields to Koha-Auth-Number:w index
Looking at the default framework's fields that are linked to authority
records, there's a divergence with the Zebra index definitions.

This yields to authority usage count be incorrect for users searching
for authority records.

MariaDB [koha_kohadev]> SELECT tagfield,tagsubfield,authtypecode FROM
marc_subfield_structure WHERE authtypecode IS NOT NULL AND
authtypecode<>'' AND frameworkcode='' GROUP BY
tagfield,tagsubfield,authtypecode ;
+----------+-------------+--------------+
| tagfield | tagsubfield | authtypecode |
+----------+-------------+--------------+
| 100      | a           | PERSO_NAME   |
| 110      | a           | CORPO_NAME   |
| 111      | a           | MEETI_NAME   |
| 130      | a           | UNIF_TITLE   |
| 440      | a           | UNIF_TITLE   |
| 600      | a           | PERSO_NAME   |
| 610      | a           | CORPO_NAME   |
| 611      | a           | MEETI_NAME   |
| 630      | a           | UNIF_TITLE   |
| 648      | a           | CHRON_TERM   |
| 650      | a           | TOPIC_TERM   |
| 651      | a           | GEOGR_NAME   |
| 654      | a           | TOPIC_TERM   |
| 655      | a           | GENRE/FORM   |
| 656      | a           | TOPIC_TERM   |
| 657      | a           | TOPIC_TERM   |
| 658      | a           | TOPIC_TERM   |
| 662      | a           | GEOGR_NAME   |
| 690      | a           | TOPIC_TERM   |
| 691      | a           | GEOGR_NAME   |
| 696      | a           | PERSO_NAME   |
| 697      | a           | CORPO_NAME   |
| 698      | a           | MEETI_NAME   |
| 699      | a           | UNIF_TITLE   |
| 700      | a           | PERSO_NAME   |
| 710      | a           | CORPO_NAME   |
| 711      | a           | MEETI_NAME   |
| 730      | a           | UNIF_TITLE   |
| 796      | a           | PERSO_NAME   |
| 797      | a           | CORPO_NAME   |
| 798      | a           | MEETI_NAME   |
| 799      | a           | UNIF_TITLE   |
| 800      | a           | PERSO_NAME   |
| 810      | a           | CORPO_NAME   |
| 811      | a           | MEETI_NAME   |
| 830      | a           | UNIF_TITLE   |
| 896      | a           | PERSO_NAME   |
| 897      | a           | CORPO_NAME   |
| 898      | a           | MEETI_NAME   |
| 899      | a           | UNIF_TITLE   |
+----------+-------------+--------------+

This patch adds the missing ones to the authority number index as it is
done for the rest of the fields.

To test:
- Verify that
etc/zebradb/marc_defs/marc21/biblios/biblio-koha-indexdefs.xml
contains intries pointing the $9 subfield of all the fields in the
'tagfield' column above, to the Koha-Auth-Number:w index.
- Sign off :-D

Signed-off-by: Hugo Agud <hagud@orex.es>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 21d63c8fb0)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit c4f977b76f)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-02-20 10:28:07 +01:00
Marcel de Rooy 973bf93c69 Bug 17512: Improve handling dates in C4::Items
This is a follow-up on the internal server error on 0000-00-00 in the items
column onloan. This patch deals with preventing to have such dates at all
in the date fields of items.

It is accomplished by:
[1] Adding a (private) subroutine _mod_item_dates. It takes an item hash
    and replaces date values if needed.
[2] AddItem and ModItem call _koha_new_item resp. koha_modify_item. In these
    routines a call to the new _mod_item_dates is inserted.
[3] Although the routine is actually private, I have added some unit tests
    to Items.t.

Test plan:
[1] Add a new item. Fill a correct date in dateaccessioned and an invalid
    date in Price effective from (=replacementpricedate).
[2] Verify that dateaccessioned is saved correctly and replacementpricedate
    is still null (does not contain 0000-00-00).
[3] Edit the item again. Fill some text in dateaccessioned and put a correct
    date in replacementpricedate. Verify the results.
[4] Run t/db_dependent/Items.t

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 137cbd8d09)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit cb1bc00361)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-02-20 10:23:38 +01:00
Jonathan Druart 47cd8dac59 Bug 16115: Remove JS error on item search if NOT_LOAN values do not exist
If NOT_LOAN is not present, the item search form will raise a JS error:
SyntaxError: expected expression, got '}'

This patch fixes it by handling this specific case.

Note that the "Status" column is still displayed.

Test plan:
Remove your NOT_LOAN authorised values
Go on the item search form
=> You will not get the JS error and the "Status" bloc is no longer
displayed. There is no need to display it if empty.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 27a4149625)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit e0b64c0f4a)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-02-20 10:09:59 +01:00
Luke Honiss da8f4e0aa3 Bug 11450: Hold Request Confirm Deletion
==TEST PLAN==
1) Go to an item with a hold and click on the holds tab on the
left
2) Click the red 'X'
3) The hold will be deleted immediately
4) Apply patch
5) Return to an item with a hold and click the 'X'
6) There will now be a confirmation dialog
7) Click cancel and the dialog will disappear and the hold will not be
deleted
8) Click OK and the hold will be deleted

Restored indentations - Mark Tompsett

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Christopher Brannon <cbrannon@cdalibrary.org>

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 6ce97d9b06)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 2d363f136d)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-02-20 10:06:47 +01:00
Julian Maurice 03c5625371 Bug 17782: deletedborrowers.updated_on should be set to current timestamp 2017-02-09 10:51:54 +01:00
Lari Taskula b42c7b8d44 Bug 16387: Fix default shortened loan period time
When a loan period is shortened due to using decreaseLoanHighHolds* the time is
always set to the current time in X days, even if the original loan period is
given in days and not in hours.

It should default to 23:59 as is normal for loan periods given in days.

As original due date time defaults to 23:59 when given in days, this patch
modifies the hours and minutes of shortened due date to be equal to original due
date.

To test:
1. prove t/db_dependent/DecreaseLoanHighHolds.t

Signed-off-by: Grace McKenzie <grace.mcky@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 21ac9fcdc2)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 090f2885b7)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-02-09 10:40:43 +01:00
Julian Maurice ab135c07aa Bug 17922: Use correct number of digits when replacing date placeholders
This patch also fixes a typo ("<<MM><" should be "<<MM>>")

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 95e94766af)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit fdf1f97477)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-02-09 10:35:59 +01:00
Tomas Cohen Arazi bd29f17c65 Bug 17871: (followup) Remove zebra::* from the packages templates
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 58e7a0a5d5)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 0e50ef7c2a)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-02-09 10:34:19 +01:00
David Cook 82db12af6f Bug 17871: Remove zebra::snippet to allow access to facets in YAZ 5.8.1+
This patch restores access to zebra facets (or zebra::snippet) with YAZ 5.8.1 or higher.

It was failing due to The <retrieval syntax="xml" name="zebra::*" /> entry in
retrieval-info-bib-dom.xml which IndexData said it wasn't even needed to
get that access.

Edit: I amended the commit message (tcohen)

Signed-off-by: Colin Campbell <colin.campbell@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
I tested on kohadevbox and found no regression or behaviour change. I
will provide a followup for the packages.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 0eb5d8491e)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 62848b134c)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-02-09 10:34:19 +01:00
Jonathan Druart 7d69d5be1a Bug 18044: Add a test
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 80a43833f8)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit d13835de10)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-02-09 10:31:17 +01:00
Chris Nighswonger a76fe18ca4 Bug 18044: Label Batches not displaying
SQL expects lists to be comma separated. A trailing comma must also
be avoided.

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 544cf17d6f)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit b61ff54061)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-02-09 10:31:17 +01:00
Dobrica Pavlinusic e2d9cc0251 Bug 17775 - Add new user with LDAP not works under Plack
This patch fixes internal server error:

Undefined subroutine &C4::Auth_with_ldap::AddMember called at /srv/koha_ffzg/C4/Auth_with_ldap.pm line 213.

It occurs only under plack, and it's strange since C4::Members
does EXPORT AddMember and we are importing it into Auth_with_ldap.pm
(and it does work under CGI).

Signed-off-by: Liz Rea <liz@catalyst.net.nz>

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
I did not test but trust author and signoffer. The change cannot hurt.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 4740438b41)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit e005d17bb6)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-02-09 10:28:32 +01:00
Julian Maurice 47d7e1da75 Add missing 'use' in C4/Items.pm 2017-02-09 10:25:05 +01:00
Jonathan Druart f2694ea4a9 Bug 15030: Add tests
This test will prevent regression on the lost of data when
items.itemcallnumber is linked with a plugin.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit eee1f23bc4)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 6f959cd149)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-02-09 10:16:47 +01:00
Blou d7d79b2af9 Bug 15030 - Fixes the serials fields associated with a plugin, to not overwrite the previously saved value
This fixes the remaining fields from serials-edit.pl that were seeing their previously entered values
be oblitarated with each new edit.  The fields associated to a plugin (dateaccessioned and barcode) were
always displaying <empty> with each new edit, losing the previous effort.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 1017edad1c)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 18ad4150ea)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-02-09 10:10:28 +01:00
Blou 9bc4064947 Bug 15030 - Certain values in serials' items are lost on next edit
When editing serials subscription, we can edit them but some values are not pulled from the DB correctly to be put in the edit box.  If not noticed, the value will be overwritten on the next save.

Test:
- Create a subscription
- Edit itemcallnumber (952o?) and make sure to have a different value than the default one.
- Save.
- Edit it again
- The saved value is not there.

This is true for itemcallnumber and a few other fields.

This was caused by calls to ->field($subfield).  This would always fail, of course.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 4cdcdb3cb5)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 3f084924e6)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-02-09 10:10:28 +01:00
radiuscz 7abba8fccb Bug 17487: Styling moved from style attribute into staff-global.css
Test plan:
1) Apply patch
2) Display Z39.50 search dialogs:
   - cataloguing / new from Z39.50
   - authorities / new from Z39.50
   - acquisition / new from an external source
3) Select all / Clear all should be placed below "Search targets" header
4) [Optionally] Set some style in IntranetUserCSS for class z3950checks

https://bugs.koha-community.org/show_bug.cgi?id=17487

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit aaf6b6724f)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 2cf8c4b3c2)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-02-09 10:04:50 +01:00
radiuscz 11fd2e0c4b Bug 17487: Links to "select/clear all" moved below the header tag
Test plan:
1) Apply patch
2) Display Z39.50 search dialogs:
   - cataloguing / new from Z39.50
   - authorities / new from Z39.50
   - acquisition / new from an external source
3) Select all / Clear all should be placed below "Search targets" header

https://bugs.koha-community.org/show_bug.cgi?id=17487

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit f05b2986da)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 5089001faa)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-02-09 10:01:07 +01:00
Nick Clemens 91120fee8c Bug 8361 (QA Followup) Add warnings
- Added message to circulation.tt to warn if rule undefined for
patron/itemtype combination

To test:
1 - Remove all circ rules
2 - Add one rule
3 - Checkout to patron an itemtype that is outside of rule
defined above
4 - Note explanation that no rule is defined

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 63f7cbc777)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 9b23c35086)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-02-09 09:36:09 +01:00
Jonathan Druart 809b0a28b7 Bug 8361: Do not allow checkouts if no rules are defined
We should require a circulation rule to allow checkouts and reject them
if no rules are defined.

Test plan:
- Delete all issuing rules
- Check an item out
=> Without this patch the checkout is allowed
=> With this patch applied it is rejected

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 11dfb2e0b2)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 32c8bf4a3d)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-02-09 09:36:09 +01:00
Karen Jen bd3188a2b3 Bug 17823: Add label for MARC 583 - Action note
test plan
Edit a record
Edit field 583a to add an action note
Save the record and confirm that the note does not show up in staff
client or opac
Apply patch and refresh page
Action note should now show up in staff client and opac

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 16dcea2330)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 36685a439a)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-02-09 09:30:01 +01:00
Julian Maurice ce1cdb5794 Increment version for 3.22.16 release 2017-01-31 10:16:05 +01:00
Julian Maurice eae5eacce0 Update release notes for 3.22.16 release 2017-01-31 09:59:37 +01:00
Katrin Fischer ff4bfb7644 Bug 17902: Follow-up fixing SQL statement
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 40cb8e3b75)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit dea3bc855d)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-01-31 09:30:40 +01:00
Jonathan Druart 00ab72b2f6 Bug 17902: Fix possible SQL injection in serials editing
/cgi-bin/koha/serials/serials-edit.pl?serstatus=*/+,2,3,'2016-12-12','2016-12-12',6,'jjj7','jjj8'%20--%20-&subscriptionid=1+and+1%3d2+Union+all+select+111+/*

The SQL query is not constructed correctly, placeholders must be used.
Subscription id and status list can be provided by the user.

This vulnerability has been reported by MDSec.

Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit f42dbd67d1)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 14e2c2e5f7)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-01-31 09:30:40 +01:00
Jonathan Druart 392b65534d Bug 17901: Force context to scalar
See bug 15809 for more references.

Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit cb4fa17a27)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-01-30 16:28:58 +01:00
Jonathan Druart 5b03c19c12 Bug 17901: Fix possible SQL injection in shelf editing
It has been reported that
/cgi-bin/koha/opac-shelves.pl?op=edit&referer=view&shelfnumber=146&owner=4&shelfname=testX&sortfield=titleaaaaaa\`&category=1

Could lead to SQL injection
Actually it explodes because the generated SQL query is not correctly formated.

However it would be good to limit the possible values for sortfield.

This vulnerability has been reported by MDSec.

Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 45cffd874c)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-01-30 16:28:57 +01:00
Jonathan Druart 72d905d8dc Bug 17900: Update the tests to the new API
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 42460b8714)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-01-30 16:25:01 +01:00
Jonathan Druart b5b633b9eb Bug 17900: Fix possible SQL injection in patron cards template editing
To recreate:
/cgi-bin/koha/patroncards/edit-template.pl?op=edit&element_id=23%20and%201%3d2+union+all+select+1,user(),@@version+--%20

Look at the Profile dropdown list.

To fix this problem and to make sure it does not appears anywhere else
in the label and patroncards modules, I have refactored the way the
queries are built in C4::Creators::Lib
Now all of the subroutine takes a hashref in parameters with a 'fields'
and 'filters' parameters.
From these 2 parameters the new internal subroutine _build_query will
build the query and use placeholders.

Test plan:
1/ Make sure you do not recreate the vulnerability with this patch
applied.
2/ With decent data in the labels and patroncards modules, compare all
the different view (undef the New and Manage button groups) with and
without this patch applied.
=> You should not see any differences.

This vulnerability has been reported by MDSec.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit a70980d825)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-01-30 16:25:01 +01:00
Jonathan Druart 23d3ca374f Bug 9569: Security patch for AutoLocation
If a patron is not allowed to access the staff interface because its IP
address in the authorised range of IPs, the cookie should not contain
the CGISESSID.
If it is, the patron is logged in and will be able to access the staff
interface if he reload the page (or hit another one).

Test plan:
Confirm the that AutoLocation feature is now working as expected.

Note: It seems that this feature has never really worked as intended.
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 93cc0956a9)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-01-30 16:22:28 +01:00
Jonathan Druart bb39ed1028 Bug 9569: Update warning message
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 7afddcb157)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-01-30 16:22:27 +01:00
Jonathan Druart f985ef45bd Bug 9569: Do not check the IP for login at the OPAC
At the OPAC, the AutoLocation feature should not be taken into account:
login to the OPAC from outside the IP range should work

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit af0af36bb9)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-01-30 16:22:26 +01:00
Jonathan Druart 599e5791b9 Bug 9569: Remove unused occurrence of AutoLocation
`git grep ManualLocation` does not return any results

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 936b23e17a)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-01-30 16:21:06 +01:00
Jonathan Druart f97589ddd1 Bug 9569: AutoLocation should not depend on IndependentBranches
Those 2 prefs can be independent and it does not make sense to consider
AutoLocation only if IndependentBranches is set.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit acabdc87c9)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-01-30 16:21:04 +01:00
Jonathan Druart 5af583c4e1 Bug 9569: Fix AutoLocation - handle .* for subnets
The example in branches.tt is:
  Can be entered as a single IP, or a subnet such as 192.168.1.*

But actually the regex in C4::Auth does not handle subnets.

Test plan:
0/ Apply all the patches
1/ Switch AutoLocation on
2/ Define a subnet (192.168.0.* if your ip is like 192.168.0.X) in the IP
range of your library
3/ Log in on the staff interface
=> Should work

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit a8fdac38d8)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-01-30 16:17:20 +01:00
Jonathan Druart 8ba4026aab Bug 17903: Fix possible SQL injection in serial claims
To recreate:
/cgi-bin/koha/serials/claims.pl?serialid=1)and%20(select*from(select(sleep(20)))a)--%20&letter_code=0

Notice the delay.

The SQL query is not constructed correctly, placeholders must be used.

This vulnerability has been reported by MDSec.

Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 179ff58b09)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-01-30 15:54:18 +01:00
Julian Maurice 652c627314 Revert "Bug 17494: Prevent duplicate tokens from getting stored"
This reverts commit 8156e86a30.
2017-01-25 16:15:32 +01:00
Julian Maurice 07ff58ceb6 Revert "Bug 17494: (QA followup) Fix exception name"
This reverts commit f508096d92.
2017-01-25 16:15:31 +01:00
Julian Maurice 45b3a62a37 Update release notes for 3.22.15 release
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-01-23 12:21:47 +01:00
Julian Maurice 6a291b3ac7 Increment version for 3.22.15 release
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-01-23 12:21:47 +01:00
Julian Maurice 74293f0702 Translation updates for 3.22.15
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-01-23 12:21:41 +01:00
Nick Clemens 0af4a1678b Bug 17949: Fix batch patron deletion tool
The filter 'who have not borrowed since' was ignored

Reword 'not_borrowered_since' to 'not_borrowed_since'

This patch is originally a followup of bug 10612

Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-01-20 13:43:21 +01:00
Jonathan Druart d0d628c611 Bug 17234: Need to separate KEY and FOREIGN KEY checks
In the previous patch we use the constraint_exists subroutine to verify
if an index or a foreign key exists.
But the `SHOW INDEX` query does not return foreign keys (as its name
suggests!).
We need another subroutine foreign_key_exists to check the FK existence.

I have found that because t/db_dependent/TestBuilder.t fails on
oai_sets_biblios, because oai_sets_biblios_ibfk_1 has not been removed.

Test plan:
0/ Do not apply this patch
1/ Use a 3.20 DB
2/ update the DB
3/ SHOW CREATE TABLE oai_sets_biblios
will display oai_sets_biblios_ibfk_1

Apply the patch and repeat 1, 2, 3
=> Will not display oai_sets_biblios_ibfk_1
It has been removed as expected.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 05fdd855c8)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit ba45608b0d)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-01-19 16:36:53 +01:00
Jonathan Druart 6086ae2f0b Bug 17234: Test the column and constraint non-existence
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 435b7badc2)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit cd6782d5b4)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-01-19 16:36:52 +01:00
Mark Tompsett 691136da81 Bug 17234: Two new functions lack tests
This adds two tests to t/db_dependent/Installer.t

TEST PLAN
---------
1) Apply patch
2) prove -v t/db_dependent/Installer.t
   -- column and constraint tests were added.
3) run koha qa test tools

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 8938631f38)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 4518ec795d)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-01-19 16:36:52 +01:00
Jonathan Druart c6927e6ef0 Bug 17234: Move new subroutines to C4::Installer
Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 0b15c5e2cc)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit a34a60823f)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-01-19 16:36:52 +01:00
Jonathan Druart 96c27a95d5 Bug 17234: Add constraint_exists and column_exists to updatedatabase.pl
These 2 subroutines will help us deal with the absense of ALTER IGNORE
TABLE

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit c08922180e)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 70fe225bea)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-01-19 16:36:41 +01:00
Blou 2e5c2a8201 Bug 17234 - updatedatabase.pl's ALTER IGNORE break with mysql 5.7.4+
The doc says: "As of MySQL 5.7.4, the IGNORE clause for ALTER TABLE is removed and its use produces an error."
This fix replaces ALTER IGNORE with ALTER in updatedatabase.pl

To TEST, try an upgrade from 3.18 to 3.22 after installing the latest mysql (at least 5.7.4, by the doc).
Some will fail with error

DBD::mysql::db do failed: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'IGNORE TABLE aqbasket
            ADD KEY authorisedby (authorisedby)' at line 1 [for Statement "
        ALTER IGNORE TABLE aqbasket
            ADD KEY authorisedby (authorisedby)
    "] at ./installer/data/mysql/updatedatabase.pl line 10563.

0) Find a database on 3.18, save it.
1) Set your code base to 3.22(or master)
2) run updatedatabase.pl
3) See the errors.
4) Apply the patch
5) Reload the 3.18 database
6) succeed with updatedatabase.pl

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit acf425bbbc)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit e2e61a798c)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-01-19 16:35:09 +01:00
Mark Tompsett d0543e3dde Bug 15711: Follow up batch_id not used
Changed batch_id to image_id in the template, as the multiparam
would catch the array case.

TEST PLAN
---------
1) attempt to delete a selected item, but get a warning.
2) apply this follow up
3) attempt to delete a selected item, it deletes.
4) run koha qa test tools

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 2ee5cd2712)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit c1768e08cd)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-01-19 16:30:20 +01:00
Aleisha Amohia becf8e9466 Bug 15711: Fixing the 'Delete selected' button on patroncard images
To test:
1) Go to Tools -> Patron Card Creator -> Manage images
2) Upload an image if you haven't already
3) Click Delete selected without selecting any images
4) Notice broken behaviour as described in Description
5) Apply patch, refresh page
6) Click Delete selected without selecting any images
7) Notice alert. Click OK
8) Select one image or more, click Delete selected
9) Notice confirm delete message.

Sponsored-by: Catalyst IT

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit bd3879e037)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(cherry picked from commit 70c55a6d69)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
2017-01-19 16:30:20 +01:00