Commit Graph

57428 Commits

Author SHA1 Message Date
Hammat Wele f970d0b7f3
Bug 41690: (follow-up) Add test
Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit a0b92c0bb6)
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 9b394ddb7a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2026-07-17 14:12:38 +02:00
Hammat Wele a969fe51a2
Bug 41690: Add MARC21 245 (subtitle) to Cite option
The "Cite" option in the OPAC is missing the subtitle (245) in MARC21.

To recreate:
1. Add a record or find a record with a subtitle (in KTD, biblionumber 58 has a 245 http://localhost:8081/cgi-bin/koha/catalogue/MARCdetail.pl?biblionumber=58
2. In the OPAC, go to the record
   http://localhost:8080/cgi-bin/koha/opac-detail.pl?biblionumber=58
3. Click "Cite"
   --> The subtitle is not in any of the citations
4. Apply the patch
5. Repeat step 2 and 3
    --> The subtitle is now shown

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 412e4e4d95)
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit ea6fd886a0)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2026-07-17 14:11:19 +02:00
Lucas Gass a524dbd403
Bug 42262: encodeURIComponent for the 006 value
To test:
1- have a MARC record with Type of Material "BKS - Books" that does not have an 006 defined (biblio 1 in the KTD default data will work)
2- edit the biblio in the basic editor
3- open the tag editor for the 006
4- observe that the values along the top of the tag editor window show a value of "" (blank) in position 17
5- click Save in the tag editor window
6- confirm that the values in the 006 tag end with a space
7- open the 006 tag editor again
8- observe that the values along the top of the tag editor window no longer show any value for position 17. Instead, they end with the zero in position 16
9- click Save in the tag editor window
10- confirm that the values in the 006 tag now end with a zero, not followed by a space
11- save your biblio
12- edit the biblio in the basic editor again, get warning "The following fixed-length control field(s) have an invalid length: 006. Please fix."
13- APPLY PATCH and restart_all
14. Try editing the 006 value again, the whitespace should be preserved and you get no error.

Signed-off-by: Justin Swink <Justin.Swink@littleelm.gov>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 1a0501f5e8)
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit f26f323aee)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2026-07-17 14:09:03 +02:00
Lucas Gass b25d8814ae
Bug 37143: Do not allow required fields with only whitespace to be submitted
To test:
1. Make some fields for OPAC self registration required.
2. Create a new patron via self reg.
3. Fill out those required fields as an empty string like "  ".
4. Submit the form, it succeeds.
5. APPLY PATCH, restart_all
6. Try again. Required fields with only whitespace are treated as if they were empty.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
(cherry picked from commit 12426b5924)
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 01df1563bf)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2026-07-08 07:39:35 +02:00
Paul Derscheid 5563202f84
Bug 41352: Add link to the manual for the Bookings to Collect page
To test:
- Go to Circulation > Bookings to collect
- Click Help
- Verify it links to the correct manual section

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit f53159bfa4)
Signed-off-by: Jacob O'Mara <jacob.omara@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit d6f529c38c)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2026-07-08 07:39:34 +02:00
Jonathan Druart dc4144ff7b
Bug 42130: ERM - Index biblio when local title is created/updated
The indexation step has been removed by
  commit d2820f57d6
  Bug 34788: (QA follow-up)

Koha/ERM/EHoldings/Title.pm
-            C4::Biblio::ModBiblio( $record, $self->biblio_id, '' );
+            C4::Biblio::ModBiblio( $record, $self->biblio_id, '', { skip_record_index => 1 } );

From the commit message:
2) The background job now uses skip_record_index to avoid queuing indexing jobs for every new biblio and instead queues one job at the end

it's then missing when we add or edit a local title.

Test plan:
1 - Enable ERMModule
2 - Go to ERM
3 - eHoldings->Titles
4 - New title
5 - Populate the form
6 - Check the create bibliographic record box
7 - Save
=> Confirm that the biblio is now indexed
8. Edit the title, modify a value, tick the box, save
=> Confirm that the biblio is now indexed with the new value

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 5dcec8b803)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 1dac2edcf6)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2026-07-08 07:39:34 +02:00
Eric Phetteplace 379794d548
Bug 42723: Purchase suggestion 500 when EmailPurchaseSuggestions is set to BranchEmailAddress
Testing plan:
- Set EmailPurchaseSuggestions to BranchEmailAddress
- Go to create suggestion on the staff side /suggestion/suggestion.pl?op=add_form
- Create a suggestion with Library: Any
- 500 error: inbound_email_address is not a method of undef
- Apply patch & repeat
- Suggestion created

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 33a8dc5d6f)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit f699bb4c50)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2026-07-08 07:39:33 +02:00
Martin Renvoize ee71d95015
Bug 42726: Add 26.11 release team
Add the 26.11 release team as voted at the development meeting.

Pedro Amorim as Release Manager, with Tomás Cohen Arazi and Martin
Renvoize as RM Assistants. Lisette Scheer as QA Manager with a
19-person QA team. David Cook as Security Release Manager.

Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit f0bb03d6e9)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit bbff807136)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2026-07-08 07:39:32 +02:00
Martin Renvoize 63bf386697
Bug 42726: Fix 25.11 QA team list to match dashboard
Update the 25.11 QA team to reflect the definitive list from the
dashboard. Remove Aleisha Amohia and Julian Maurice who did not
appear in the final count, and add John Vinke, Matt Blenkinsop,
Alex Carver and Victor Grousset who did. Reorder by descending
QA count.

Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 5d12a83751)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
2026-07-08 07:39:31 +02:00
Fridolin Somers 926655c0a8
Update release notes for 24.11.17 release
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2026-06-24 10:34:08 +02:00
Fridolin Somers bd3ef5f037
Increment version for 24.11.17 release
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2026-06-24 10:20:07 +02:00
Jonathan Druart 8ddc98a6fc
Bug 42735: [24.11] Fix SQL injection
This change fixes an SQL injection in the circulation stats.

Test plan:
0. Apply the patch
1. sudo koha-plack --restart kohadev
2. Go to /cgi-bin/koha/reports/issues_stats.pl
3. Try out a bunch of options
4. Try to break it
5. Note that you just get output and no errors

Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
(cherry picked from commit da14a2f672330d445b442cd057bd72688bfb0c37)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2026-06-18 15:50:41 +02:00
Jonathan Druart caa66ac91f
Bug 42369: [24.11] Use C4::Context::csv_delimiter for delimiter validation
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit bd98e67192f955faf402b56f8933bc3997ce9e7e)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2026-06-18 15:50:41 +02:00
David Cook f6049a2d27
Bug 42369: [24.11] Fix SQL injection
This change fixes SQL injection in bor issues top

Test plan:
0. Apply patch
1. sudo koha-plack --restart kohadev
2. Go to /cgi-bin/koha/reports/bor_issues_top.pl
3. Try out all the different options
4. Try to break it
5. Note that you get output and no errors

Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 0d1efd812b9d1d6ac8fe71b7115f5368b8ba271f)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2026-06-18 15:50:41 +02:00
Jonathan Druart 79b9b1cd91
Bug 42368: [24.11] Use C4::Context::csv_delimiter for delimiter validation
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
(cherry picked from commit ab36cbffc837a3e7ac7dcd501fb510ea5c7059b0)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2026-06-18 15:50:40 +02:00
David Cook 92865a3bec
Bug 42368: [24.11] Fix SQL injection in issue avg stats
This change fixes SQL injection in issues avg stats

Test plan:
0. Apply the patch
1. sudo koha-plack --restart kohadev
2. Go to /cgi-bin/koha/reports/issues_avg_stats.pl
3. Try out all the different options
4. Try to break the report
5. Note that you always get output instead of errors

Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
(cherry picked from commit f0d3bf850b8ff85c9393126763b1477d1cdc5c09)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2026-06-18 15:50:40 +02:00
Jonathan Druart 202dafc63b
Bug 42363: [24.11] Use C4::Context::csv_delimiter for delimiter validation
(cherry picked from commit 710c20075396beaeee056efeec28fc95d10fbb1d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2026-06-18 15:50:39 +02:00
David Cook 171c7044fd
Bug 42363: [24.11] Fix SQL injection
This change cixes an SQL injection in cat stats

Test plan:
0. Apply patch
1. sudo koha-plack --restart kohadev
2. Go to /cgi-bin/koha/reports/catalogue_stats.pl
3. Try out different values
4. Try to break the report
5. Note that you just get output and not errors

Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>
(cherry picked from commit a9f741b79d231d81e7cdaef2201b8c00c9efe349)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2026-06-18 15:50:39 +02:00
Jonathan Druart bfe9cfa6f4
Bug 42360: [24.11] Move separator validation to C4::Context::csv_delimiter
So we protect other calls

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2026-06-18 15:50:38 +02:00
David Cook a4a23224d0
Bug 42360: [24.11] Also validate sep param
Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2026-06-18 15:50:38 +02:00
David Cook 9888d6745f
Bug 42360: [24.11] Fix SQL injection
This change fixes an SQL injection in the acq stats.

Test plan:
0. Apply the patch
1. sudo koha-plack --restart kohadev
2. Go to /cgi-bin/koha/reports/acquisitions_stats.pl
3. Try out a bunch of options
4. Try to break it
5. Note that you just get output and no errors
NOTE: In a fresh KTD you likely don't have any actual statistics

Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2026-06-18 15:50:37 +02:00
Fridolin Somers 178312e403
Bug 39301: (RMaint follow-up) Fix missing var Koha::Statistic::pseudonymization_types 2026-06-18 15:47:31 +02:00
David Cook ae0aacd76b
Bug 41045: Fix BZ 33363 database update
This patch fixes the BZ 33363 database update, so that it
selects uses with the "suggestions" permission rather than the "catalogue"
permission.

Signed-off-by: Emmi Takkinen <emmi.takkinen@koha-suomi.fi>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
(cherry picked from commit 0442f4ce2c)
Signed-off-by: Jacob O'Mara <Jacob.omara@openfifth.co.uk>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
(cherry picked from commit 4c8e0f0a6d)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
2026-06-17 14:45:33 +02:00
Baptiste Wojtkowski 76e3b6ec92
Bug 38414: [24.11.x] (follow-up) Fix template syntax 2026-05-29 12:41:59 +00:00
Baptiste Wojtkowski a1f7766ac9
Update release notes for 24.11.16 release
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
2026-05-28 10:28:30 +00:00
Baptiste Wojtkowski 1483f4b24e
Increment version for 24.11.16 release
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
2026-05-28 10:16:50 +00:00
David Cook 1c543663e5
Bug 42361: Fix SQL injection in catalogue_out.pl
This change removes an SQL injection vulnerability from catalogue_out.pl

Test plan:
0. Apply the patch
1. Go to koha-conf.xml and change the following:
<strict_sql_modes>1</strict_sql_modes>
to:
<strict_sql_modes>0</strict_sql_modes>
2. sudo koha-plack --restart kohadev
3. Go to /cgi-bin/koha/reports/catalogue_out.pl
4. Try out the various options and note no errors occur

Signed-off-by: Sanjar Tulkinov Anvar o'g'li <sanjarbiy11@gmail.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2026-05-28 10:12:20 +00:00
Jonathan Druart ea94cfd31b
Bug 38414: [24.11.x] Fix permission controller-side
This bug refactors the preview sql buttons to pass the permissions granted for each report to
the javascript that clones and updates the modal.

That allows us to check for the appropriate permissions when preparing the buttons for the modal
and to remove any that are not allowed.

This allows for different permissions per report for future devs
(see bugs 42406, 16631)

To test:
1. Create some reports
2. Create a user with only execute_reports permissions
3. Login as that user and go to Reports > use saved
4. In the actions column click the ^ and select 'Preview sql'
5. Notice delete button renders and works to delete
6. Apply patch and restart_all
7. Repeat step 4, now only the Run report button renders and works
8. Add permissions for create_reports
9. Repeat step for, now Edit, Duplicate, Schedule and run buttons render and work
10. Add permissions for delete_reports
11. Repeat step 4, confirm the delete button renders and works
12. Confirm the preview sql button works to preview different reports

We also fix some error in the script, several wrong things there:
* delete was not replaced with cud-delete
* missing op for the creation of new reports
* update and run requires two permssions

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Scott Barter <sbarter@aacpl.net>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
2026-05-28 10:09:20 +00:00
Fridolin Somers 61056b323e
Bug 42224: (Bug 40524 follow-up) [24.11.x] Fix XSS in columns_settings.inc
Bug 40524 fixed XSS issue in koha-tmpl/intranet-tmpl/prog/js/datatables.js

But in 24.11 and lower, DataTable are also build with koha-tmpl/intranet-tmpl/prog/en/includes/columns_settings.inc
So same fix needs to applied.

Also in 24.11.x and lower the columns use "noExport" instead of "no-export"

Test plan:
Use the one from Bug 40524

Signed-off-by: David Cook <dcook@prosentient.com.au>
2026-05-28 09:13:49 +00:00
Baptiste Wojtkowski 0aafc9a60a
Revert "Bug 41976: LinkWrapper no longer mangles links"
This reverts commit 7e16e85e4f.
2026-05-28 08:43:52 +00:00
Martin Renvoize c58d465cfc
Bug 29923: Prevent overpayment credit when written-off accruing fine is adjusted on check-in
When a staff member writes off an accruing fine and the item is
subsequently checked in (backdated or in fine-free mode), the fine
amount is recalculated downward via adjust(). The previous code
unconditionally created an OVERPAYMENT credit whenever the adjusted
outstanding went negative, regardless of whether the existing credits
were reversible payments or non-reversible writeoffs/discounts.

This caused patrons to receive an erroneous credit equal to the
written-off amount, since writeoffs should simply be absorbed when
the underlying fine shrinks - no refund is due.

The fix calculates the total non-reversible credits (writeoffs,
discounts, cancellations) applied to the debit using the existing
filter_by_non_reversible method, and only generates an OVERPAYMENT
credit for the portion attributable to reversible cash payments that
exceed the recalculated fine amount.

Test plan:
1. Write off an accruing fine in full
2. Check the item in (backdated or fine-free)
3. Confirm no overpayment credit is generated for the patron

Signed-off-by: Benjamin Daeuber <BDaeuber@fargolibrary.org>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 44483cab32)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
2026-05-27 15:03:29 +00:00
Hammat Wele 28f5ca133f
Bug 40787: Plugins buttons misaligned when search box is enabled
The buttons in the plugins home page ("Upload plugin" and "View plugins by class") become misaligned when you have the git repository search bar.

To test:

1. Add a github/gitlab repository in koha-conf.xml
  - In ktd shell, open /etc/koha/sites/kohadev/koha-conf.xml
  - Somewhere under <config> insert the following (or your own)

<plugin_repos>
  <repo>
   <name>Solutions inLibro</name>
   <org_name>inLibro</org_name>
   <service>github</service>
  </repo>
</plugin_repos>

  - Save the file
  - restart_all

2. Go to Administration > Manage plugins
--> Buttons are misaligned

3. Apply the patch

4. Run command « yarn build »

5. Repeat step 2
--> buttons are aligned nicely

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit d2d49dfdc6)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
2026-05-27 15:00:42 +00:00
Lucas Gass be51075081
Bug 41417: Fix client variable in cataloging.js
To test:
1. Find or create a record in Kkoha.
2. From the record detail page click "Edit" and "Manage items"
3. Begin adding a new item
4. For any of the dropdowns that contain an authorized value ( LOST, DAMAGED, WITHDRAWN, CCODE, LOC ) click on the dropdown and begin typing an AV that doesn't exist.
5. You should see the text (select to create) appear, click it.
6. Now a modal appears "Create a new authorized value"
7. Fill out the required parts and click 'Save'.
8. Kaboom, 500 error:
9. APPLY PATCH, clear browser cache.
10. Try again, this time it should work.

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 4ba95d70e8)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
2026-05-27 14:53:57 +00:00
Marcel de Rooy 3befc5ead3
Bug 41444: (QA follow-up) Rearrange comments
It would be at least helpful to add a reference to get_transfer here,
since we are replacing it here.
Used the opportunity to update the older comments

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit eaa354e277)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
2026-05-27 14:51:52 +00:00
Nick Clemens e6baeae088
Bug 41444: Search for transfers directly
This patch removes a fetch of the item object followed but get_transfer to simply search the
transfers by itemnumber and status

To test:
1 - Add many items to your records
    https://github.com/kidclamp/handy-koha-script/blob/main/randitems.pl
    NOTE: this script makes a lot of items withdrawn or damaged, undo that for more dramatic difference
    UPDATE items SET withdrawn=0,damaged=0
    perl misc/search_tools/rebuild_elasticsearch -v
2 - Set Koha system preferences to display more results and check more items:
    maxItemsInSearchResults 60
    numSearchResults 50
3 - Do a search, several times, note the time it takes
4 - Apply patch, restart all
5 - Repeat search several times, note the time it takes
6 - Confirm it is better after the patch

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 5d62b4f614)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
2026-05-27 14:50:59 +00:00
Kevin Carnes a41c884e05
Bug 41496: Update current URL for item search
The "Copy shareable link" button on the item search table creates a link
based on the current URL, but an item search does not update the current URL
with the search parameters.

This patch copies the code to generate the URL with search parameters and
uses it to update the current URL.

Test plan:
1. Click "Item search".
2. Perform an item search (e.g. Home library is Centerville).
3. Click the "Copy shareable link" button on the right side of the screen
   above the table.
4. Paste and visit the link.
5. Observe that you only see the search page without any results.
6. Apply patch.
7. Repeat steps 1-4.
8. Observe that you see the results with the table settings.
9. Sign off.

Sponsored-by: Lund University Library
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit bfd33ed339)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
2026-05-27 14:48:23 +00:00
David Cook c3bd70316c
Bug 41518: Only show autorenewal text if autorenewal allowed
This change makes the "Scheduled for automatic renewal" text appear
in the staff interface and OPAC only if both the issue has auto_renew
and the borrower has autorenew_checkouts set. These are the criteria that
automatic_renewals.pl uses for processing automatic renewals.

Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Checkout an item as an automatic renewal
(ie either set it as Automatic renewal using the checkout option or have
 the circ and fines rules set to use Automatic renewals)
3. View the checkout in both the staff interface and the OPAC
4. Note that they both show "Scheduled for automatic renewal" or
"This item is scheduled for auto renewal" for the OPAC
5. In the patron record change "Allow auto-renewal of items" from
"Yes" to "No"
6. Note that the text talking about the item being scheduled
for automatic renewal no longer displays

Bonus points:
1. Run 'perl ./misc/cronjobs/automatic_renewals.pl -v'
2. Note that the automatic renewal doesn't show when "Allow auto-renewal
of items" is set to "No" but it does show when it's set to "Yes"

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 99e9bcf25e)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
2026-05-27 14:43:37 +00:00
Slava Shishkin 9c5a78286a
Bug 41675: Fix Quick add patron username being overwritten
Test plan:
1. In system preferences, set PatronQuickAddFields to include userid
   (Username).
2. Go to Patrons and choose Quick add new patron.
3. Fill at least Surname, Card number, and Username
   (use a value clearly different from a surname-based username).
4. Save the patron.
5. Observe on the patron details page that Username is auto-generated
   (not the value entered in quick add).
6. Apply this patch.
7. Repeat steps 2-4 with a new patron.
8. Verify on the patron details page that Username now matches the
   value entered in quick add.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 8903df398a)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
2026-05-27 12:56:39 +00:00
Roman Dolny 33a67c0311
Bug 41715: Argument "YYYY-MM-DD" isn't numeric in numeric lt (<)... warnings in issues_stats.pl
The warnings:
[WARN] Argument "YYYY-MM-DD" isn't numeric in numeric lt (<)
    at /kohadevbox/koha/reports/issues_stats.pl line 224.
appears in the plack-intranet-error.log.
It happens because a numerical comparison was used to compare the dates
instead of a string comparison.

To test:
========
1. Observe plack-intranet-error.log.
2. In staff interface go to Reports > Statistics wizards > Circulation.
3. Select date "From" and date "To" then submit.
4. Two warnings appear in plack-intranet-error.log.
5. Apply the patch; restart_all.
6. Repeat 2-3. No warnings appear in log.

Sponsored-by: Ignatianum University in Cracow
Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 330d148704)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
2026-05-27 12:54:47 +00:00
Kyle M Hall 41ca027f44
Bug 41818: Add unit tests
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 3df6e51d72)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
2026-05-27 12:54:33 +00:00
Jake Deery 204400bed2
Bug 41818: Add new Koha::Patron::Message method to SIP2
This bug adds Koha::Patron::Message::message_without_newlines, which has been added to C4::SIP::ILS::Patron in lieu of Koha::Patron::Message::message. The aim of this change is to prevent SIP2 units from crashing out when they encounter a patron message with newlines (\n or \r) in it, as units generally use a newline character to denote the end of a SIP2 transaction.

To test:
a)  go to /cgi-bin/koha/sip2/institutions
    *)  create an institution, name CPL, timeout 300, the rest default
b)  go to /cgi-bin/koha/sip2/accounts
    *)  create an account, userid koha, institution CPL, terminator crlf, the rest default
c)  go to /cgi-bin/koha/members/moremember.pl?borrowernumber=51
    *)  click add message in toolbar
    *)  enter some multi-line message e.g. test[RETURN]1[RETURN]2[RETURN]3[RETURN][RETURN][RETURN]
d)  run tail -f /var/log/koha/kohadev/sip-output.log, keep this window open
e)  run ./misc/sip_cli_emulator.pl -a 127.0.0.1 -p 6001 -su koha -sp koha -l CPL --patron 42 -m patron_information
f)  look at the tail log, notice how the MSG 64 line has a newline before the final pipe (|) character
== APPLY PATCH ==
g)  restart_all
h)  repeat steps e-f
i)  notice how in the tail log, the MSG 64 line now has the final pipe character contiguously placed with the successive characters
== SIGN OFF ==

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit a16316a5c3)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
2026-05-27 12:54:06 +00:00
Kyle M Hall 9b8cc84815
Bug 41811: SIP server will inadvertently remove non-alphanumeric characters from the end of a message
If a message ends in a non-alphanumeric character, that character is stripped from the message.

For example:
6300120260210    182641          AOMPL|AA23529000035676(|

64              00120260210    182831000000000000000000000000AOCPL|AA23529000035676|AEHenry Acevedo|BLY|BHUSD|BV0|CC5|BD4345 Library Rd. Springfield, MA 44224|BF(212) 555-1212|PB19580530|PCS|PIY|AFGreetings from Koha. |

versus:
6300120260210    182641          AOMPL|AA23529000035676(|ACkoha|

64YYYY          00120260210    182835000000000000000000000000AOCPL|AA23529000035676(|AE|BLN|AFInvalid cardnumber|

The former should be returning the same "Invalid cardnumber" message the latter does.

Test Plan ( assumes you are using KTD ):
1) Install telnet: sudo apt install -y telnet
2) telnet 127.0.0.1 6001
3) Log in with: 9300CNkoha|COkoha|CPMPL|
4) Send the patron information request: 6300120260210    183346          AOMPL|AA23529000035676(|
5) Note you get a patron back
6) Apply this patch
7) Restart SIP!
8) Repeat steps 2-5
9) Noe you doe not get a patron back in the response!

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 4a03a9dce2)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
2026-05-27 12:53:26 +00:00
Paul Derscheid 7d8d1da5a0
Bug 41886: Filter checkouts to bookable items in check_booking
- Biblio::check_booking counts current checkouts toward the
  unavailable pool to detect booking clashes
- It counts checkouts on ALL items for the biblio, including
  non-bookable ones (e.g. items with an excluded item type)
- When only a subset of items are bookable, checkouts on
  non-bookable siblings incorrectly reduce the available pool,
  producing false clashes
- Restrict the checkout query to only count items whose
  itemnumber is in the bookable items set

To test:
1. Have a biblio with at least two items, where one item is
   bookable and the other is not (bookable = 0).
2. Check out the non-bookable item to a patron.
3. Attempt to create a booking for the bookable item.
4. Without the patch: a clash is detected even though the
   bookable item is available.
5. Apply the patch.
6. Repeat steps 2-3.
7. Verify the booking succeeds without a false clash.
8. Run: prove t/db_dependent/Koha/Biblio.t
   and confirm the new subtest
   "checkouts on non-bookable items do not cause false clashes"
   passes.

Sponsored-by: Büchereizentrale Schleswig-Holstein <https://www.bz-sh.de/>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit e4be46c2c5)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
2026-05-27 12:32:54 +00:00
Roman Dolny 8eccf8bfd5
Bug 41904: "Use of uninitialized value..." warning in del_message.pl
The warning
[WARN] Use of uninitialized value in string eq at
/kohadevbox/koha/circ/del_message.pl line 54.
appears in plack-intranet-error.log

Test plan:
==========
1. Observe plack-intranet-error.log
2. Search for any patron and go to "Check out" tab.
3. Add message for patron. Added message is shown in "Message" area
   with "Edit" and "Delete" links.
4. Click "Delete" and confirm modal.
5. Warning appears in plack-intranet-error.log
6. Apply the patch; restart_all
7. Repeat 3-4. No warning appears.

Sponsored-by: Ignatianum University in Cracow

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 42908f8c68)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
2026-05-27 12:31:37 +00:00
David Nind fee8659457
Bug 41958: Rename BibTeX cart and list download options in the staff interface
This patch renames BibTex to BibTeX (with a capital X) for the staff interface
cart and list download options, to match the OPAC.

Test plan:
1. Log in to the staff interface and search for a term that returns
   results.
2. Add some records from the results to the cart (select records >
   Add to cart).
3. Add some records from the results to a new public list (select
   records > Add to list > New list > name the list > make it a
   public list > Save).
4. Note the download options for the cart and the spelling: Cart >
   Download > BibTexi (with a lowercase X).
5. Note the download options for lists and the spelling: Lists >
   Public lists > select the list > Download list > BibTex (with a
   lowercase X).
6. Go to the OPAC and search for a term that returns results.
7. Add some records from the results to the cart (select records >
   Add to cart).
8. Note the download options for the cart and the spelling (with a
   capital X): Cart > Download > BibTeX.
9. Note the download options for lists and the spelling (with a
   capital X): Lists > Public lists > the name of your list >
   Download > BibTeX.
10. Apply the patch.
11. Recheck the download options in steps 4 and 5.
12. The option should now show as BibTeX (with a capital X).

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 07e1f36a63)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
2026-05-27 12:23:10 +00:00
David Cook 28424646c9
Bug 41970: Fix typo in pa_class in template
This change fixes a typo from pa_loo to pa_class, so that
the ID attribute of the fieldset is properly set when using PA_CLASS
to group patron attributes.

Test plan:
0. Set up two PA_CLASS values
1. Set up two patron attributes which are viewable/editable on the
OPAC and assign them one class each
2. Go to http://localhost:8080/cgi-bin/koha/opac-memberentry.pl
3. Look at the HTML and note that fieldsets for both PA classes
have the ID of "aai_"

4. Apply the patch

5. Reload the page http://localhost:8080/cgi-bin/koha/opac-memberentry.pl
6. Note that now the fieldsets have ID attributes of
"aai_<PA_CLASS code>".
7. Rejoice as now it's easier to use Javascript and CSS and have valid
HTML!

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 28a54105ab)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
2026-05-27 12:21:54 +00:00
Jake Deery 7e16e85e4f
Bug 41976: LinkWrapper no longer mangles links
This patch fixes a bug where, context-dependent, LinkWrapper can keep
referencing back to links that should be out of scope.

This was causing odd behaviour whilst writing Bug 14962 - namely, links
returning as the same value in a table of multiple rows due to
LinkWrapper treating linkData.href as one and the same for each row.

TO TEST:
== APPLY PATCH ==
a)  enable ERMModule syspref, go to /cgi-bin/koha/erm/erm.pl
b)  notice all links and buttons still work as expected
c)  go to /cgi-bin/koha/sip2/sip2.pl
d)  notice all links and buttons still work as expected
e)  go to /cgi-bin/koha/acquisition/vendors
f)  notice all links and buttons still work as expected
g)  enable PreservationModule syspref, go to
/cgi-bin/koha/preservation/home.pl
h)  notice all links and buttons still work as expected
== SIGN OFF ==

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 12fdf33139)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
2026-05-27 12:15:03 +00:00
David Cook b64f41a235
Bug 41986: Add more names to Contact information and clarify preferred name
This patch adds the "Middle name" to the Contact information on moremember.pl,
and it adds "Preferred name:" when it differs from the "First name:". This
provides maximum clarity to staff users.

Test plan:
0. Apply the patch
1. Go to the "Patrons" module and search for or add a new patron
2. Add a firstname, a middle name, and a surname. Also add a "Preferred name"
which matches the firstname.
3. Go to "Details" on the sidebar, and note that "First name", "Middle name",
and "Surname" appear in the "Contact information".
4. Edit the patron and change "Preferred name" to a name that does not
match the "First name"
5. Go to "Details" on the sidebar, and note that "Preferred name" now shows
as well.
6. Enjoy fully comprehending which name is which for the patron!

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 5ecf2cc9b0)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
2026-05-27 12:14:20 +00:00
Paul Derscheid ded7e528d5
Bug 42014: (follow-up) Only show empty state when patron is not on any list
- The empty state message was shown when available_lists was empty
  but the patron was already on all existing lists
- Add !in_lists guard so the message only displays when the patron
  is truly not on any list

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 53a8761a42)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
2026-05-27 12:11:57 +00:00
Paul Derscheid c02c8db51e
Bug 42014: Show empty state message on patron lists tab
- When no patron lists exist in the system, the patron lists
  tab on the patron detail page renders completely blank
- Other tabs follow the convention of showing a message in
  the empty state (e.g. "Patron has nothing on hold.")
- Add an empty state message with a link to create a new
  patron list, matching the established pattern

To test:
- Go to a patron detail page and click the "Patron lists" tab
- If no patron lists exist, observe the tab is blank
- Apply patch
- Repeat the above steps
- Verify the tab now shows "Patron is not on any list." with
  a link to create a new patron list
- Click the link and create a patron list
- Return to the patron detail page and verify the "Add patron
  to list" dropdown now appears instead

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
(cherry picked from commit 5d9a2ec188)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
2026-05-27 12:11:56 +00:00