Commit Graph

2075 Commits

Author SHA1 Message Date
Jonathan Druart c20974570d Bug 20982: Sanitize category to prevent XSS on opac-shelves.pl
== Test plan ==
1. Go to http://localhost:8080/cgi-bin/koha/opac-shelves.pl?category=function(){window.location.href%20=%20%27https://git.koha-community.org/stats/koha-master/authors.html%27}()
2. Note that you are redirected to another website
3. Apply the patch & restart services
4. Repeat the above and you are not redirected

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
2021-05-25 14:38:10 +00:00
Lucas Gass d06db33ac5 Bug 28241: Fix regex to allow for content before and after comma
1. Set up the OPACNoResultsFound with the {QUERY_KW} placeholder.
2.Do a search with a comma that will return no results. Like "King, Martin Luther". If the returns results add some additional characters to the search until no results are returns.
3. Look at the #noresultsfound HTML element. Anything before (or after) the comma is omitted. So the placeholder looks something like 'Martin Luther' instead of 'King, Martin Luther'.
4. Apply patch
5. Try the search again, you should see the content before and after a comma

Signed-off-by: Lisette Scheer <lisettes@latahlibrary.org>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 685fcb1880)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 8bc4e05918)

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
2021-05-25 13:07:46 +00:00
Nick Clemens a363413a4e Bug 27529: Choose patron's branch or item's homebranch if following group rules and patron cannot choose branch
This patch defaults the holds pickup location to the items homebranch or the patron's branch when a group option is selected
for the hold fulfillment policy and the patron is not allowed to choose the branch on the OPAC

To test:
1 - Set 'Default checkout, hold and return policy' -> 'Hold pickup library match' to item's hold group or patron's hold group
2 - Set  OPACAllowUserToChooseBranch to 'Don't allow'
3 - Try to place an item level hold on the opac
4 - Ka-boom, etiher:
    The method Koha::Item->patrongroup is not covered by tests!
    The method Koha::Item->itemgroup is not covered by tests!
5 - Apply patch
6 - Repeat
7 - Note the pickup location is set to either the patron's branch or the items homebranch
8 - Repeat plan with the other group setting

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 99c3b9ae1f)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit b78ccb3e47)

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
2021-04-25 16:36:13 +00:00
Aleisha Amohia d52969810f Bug 27979: Modify TrackClicks to verify URL exists in DB when multiple uri
To test:
1) Go to Admin -> system preferences and enable the TrackClicks syspref
(set to Track or Track anonymously)
2) Find a record in the staff client with an item. Edit the item and put
two external URLs in the Uniform Resource Identifier field, e.g.
"https://www.google.com/ | https://twitter.com/"
3) Search for that record in the OPAC. Notice the two links in the
holdings table.
4) Click a link and confirm that you are directed to a 404.
5) Apply the patch and refresh the page
6) Click a link and confirm that you are directed to the page as
expected
7) Go back to edit the record in the staff client and remove one of the
links from the URI field
8) Go back to the OPAC and confirm you can still access the link as
expected when there is only one URI

Sponsored-by: Catalyst IT

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 0da874bde2)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 63b7ba9767)

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
2021-04-25 16:29:53 +00:00
Jonathan Druart fbc96a7d31 Bug 27650: Fix variable passed to the template in opac-main
$template->param(
+    koha_news           => @all_koha_news,

We must not pass an array, the number of elements of the hash passed to the template may be inconsistent.

It's working because of an error earlier in the script:
+    @all_koha_news   = &GetNewsToDisplay($news_lang,$homebranch);

GetNewsToDisplay returns an arrayref

Test plan:
Define at least 2 news to display on the OPAC main page
Hit opac-main.pl
=> All news are displayed
Click one
=> You see the single news you selected

Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit ca4ef19a2b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit af888cd3b8)

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
2021-03-14 19:56:32 +00:00
Jonathan Druart 4dac16fd36 Bug 27626: Fix self registration if categorycode is hidden and PatronSelfRegistrationVerifyByEmail
If categorycode is selected in
PatronSelfRegistrationBorrowerUnwantedField and
PatronSelfRegistrationVerifyByEmail is turned on, the patron self registration
fails with

   [You must provide a patron's category to validate password's strength
   and length] at /usr/share/perl5/Exception/Class/Base.pm line 88

Test plan:
0. Select categorycode in PatronSelfRegistrationBorrowerUnwantedField
   and turn on PatronSelfRegistrationVerifyByEmail
1. Self register a patron
2. Confirm that it works as expected with this patch applied.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 74ae74d5fa)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 2b021df3e2)

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
2021-03-04 21:24:42 +00:00
Jonathan Druart bf045e483a Bug 27604: Deal with empty pref
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 121b633cad)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 350fbb7da1)

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
2021-02-23 18:28:30 +00:00
Jonathan Druart 196d7311ea Bug 27604: Init to {}
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 4784b8ffe5)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit c4922f9c76)

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
2021-02-23 18:28:19 +00:00
Nick Clemens ec0cee795f Bug 27604: (QA follow-up) Limit the libraries during the query
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 60a749ff5a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 1951169055)

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
2021-02-23 18:28:09 +00:00
Jonathan Druart cd8fd0bb45 Bug 27604: Make sure PatronSelfRegistrationLibraryList is used
The value of PatronSelfRegistrationLibraryList is used to display the dropdown
list of the libraries, but not after the form is submitted.

Test plan:
1. Empty PatronSelfRegistrationLibraryList
2. Self register a new patron
=> Confirm the dropdown list with the libraries contain all the
libraries
3. Fill in PatronSelfRegistrationLibraryList with branchcodes (eg. "CPL|MPL")
4. Self register a new patron
5. Edit the HTML form and replace the option's value with another
branchcode (FPL)
6. Save
=> Without this patch the branchcode FPL is used
=> With this patch applied an ugly 500 is returned

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 376bf9b980)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 41aaad8098)

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
2021-02-23 18:27:55 +00:00
Jonathan Druart af56d2bd59 Bug 27450: Remove password from the mandatory fields when editing details
When a patron edit their personal details at the OPAC, the password must
be removed from the mandatory fields

Test plan:
0 - Don't apply the patch
1 - Set PatronSelfRegistrationBorrowerMandatoryField to require password
2 - Create or sign in as a patron on the opac
3 - Click 'Your personal details'
4 - Attempt to edit
5 - Save changes
=> They are rejected because not all required fields are populated
6 - Apply the patch
7 - Repeat 3 to 5
=> details are saved successfully
8 - Test the self registration feature and confirm that the password is
required

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 4b2c284092)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 06c47d8f5b)

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
2021-02-09 12:31:23 +00:00
Jonathan Druart bcb997bda8 Bug 15448: Remove items fetch
We fetch them already too many times.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 6cd68dd05b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 54a9ef09bf)

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
2021-01-29 21:21:35 +00:00
Jonathan Druart 6906be6c69 Bug 15448: Fix ISE
The method Koha::Items->itemnumber is not covered by tests!

Trace begun at /kohadevbox/koha/Koha/Objects.pm line 592
Koha::Objects::AUTOLOAD('Koha::Items=HASH(0x55981fd94790)') called at /kohadevbox/koha/opac/opac-reserve.pl line 465

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 9790b5ca3a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 60e08d51bb)

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
2021-01-29 21:21:18 +00:00
Tomas Cohen Arazi 7f297d7f51 Bug 15448: (follow-up) Adapt to changes on bug 24254
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 8af3ecdd53)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 655c4427c7)

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
2021-01-29 21:21:05 +00:00
Tomas Cohen Arazi bbf2348bf0 Bug 15448: (follow-up) Fetch the patron category once
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit c9f66f5e6b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit cdfea70011)

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
2021-01-29 21:20:54 +00:00
Tomas Cohen Arazi 41605172ea Bug 15448: Filter out items hidden in OPAC on placing hold
This patch leverages on bug 24254's
Koha::Items->filter_by_visible_in_opac to filter out items that
shouldn't be presented to the end user in the OPAC interface.

To test:
1. Circulation and Fine rules for item-level holds are set to allow.
2. Setting the OpacHiddenItems preference to "ccode: [SUPPRESS]"
3. An item with collection Code Suppress is set.
4. Search for the title in the OPAC.
=> SUCCESS: The Suppress ccode item isn't shown.
5. View the detail page for the title.
=> SUCCESS: The suppress ccode item isn't shown.
6. Place a hold on the item:
  -- Click "Show more options"
  -- Select "A specific item"
=> FAIL: the ccode with the opachiddenitems rule has an item that appear in the list to place a hold
7. Apply this patch and repeat 6
=> SUCCESS: The item doesn't show!
8. Sign off :-D

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 051f551986)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 284b2da589)

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
2021-01-29 21:20:43 +00:00
Jonathan Druart a3de3f1967 Bug 27230: Display OPAC description for OPAC_SUG
The authorised values OPAC_SUG displayed at the OPAC show the staff
description.

Test plan:
1. Create an auth value in opac_sug, with different text for the description and OPAC description.
2. Go to the OPAC and open the purchase suggestion form.
3. Note in the Reason for purchase drop down, the descriptions appear, the text entered in the OPAC description field.

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 7063f2c476)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit e650254cf4)

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
2021-01-04 21:58:14 +00:00
Fridolin Somers 57a9bf3ef2 Bug 26904: OPAC password recovery allows regexp in email
When using OPAC password recovery form, opac/opac-password-recovery.pl :
if one provides correct login and an email, there is a check that this email is one of patron's.

This check uses RegExp with case insensitive :
  if ( $email && !( any { /^$email$/i } @emails ) )

This is a security issue since one can simply enter '.*'.
Severity is normal because the login must be a correct.

I propose to use simple string compare with lowercase to be case insensitive.

Test plan :
1) Don't apply patch
2) Enable system preference 'OpacResetPassword'
3) Go to 'OPAC > Log in to your account > Forgot your password?'
4) Enter an existing userid or cardnumber and '.*' in 'Email'
5) The password recovery is created ! (check table 'borrower_password_recovery')
6) Apply patch
7) Enter an existing userid or cardnumber and '.*' in 'Email'
8) You get the message 'No account was found with the provided information.'
9) Enter an existing userid or cardnumber and in 'Email' the corresponding email but with different case
10) The password recovery is created (check table 'borrower_password_recovery')

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 904e926ba0)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2020-11-23 23:07:46 +00:00
Marcel de Rooy 19a3ea8c96 Bug 26464: Code correction in opac-main when news_id passed
Theoretical change. If somehow the search would return more than one result, the code is wrong.

The if test can be simplified: remove scalar and >0.
We should not pass @array to one param. It would theoretically add wrong items or
trigger an odd number warning. If it is only one, it is no problem. But it is buggy.

Test plan:
Pass an existing news_id to opac-main. Item visible?
And pass a not-existing. Error message?

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 22f14a7b6d)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2020-10-16 15:03:14 +00:00
Nick Clemens 6347ad75c8 Bug 26388: Do not show 'Renew all' or 'Renew selected' if no renewable items
Additionally, only include renewable items in 'Renew all'

To test:
1 - Check out some items to a patron, ideally:
    Some not renewable because set for auto renewal
    Some not renewable because of holds
    Some renewable
 2 - Confirm 'Renew selected' and 'Renew all' show on the opac
 3 - Click 'Renew all'
 4 - You get errors about the non-renewable items?
 5 - Check in all renewable items
 6 - Confirm you still see renew buttons
 7 - Apply patch
 8 - Refresh and you shoudl not see renew buttons
 9 - Check out a renewable item
10 - Click 'Renew all'
11 - Renewable item is renewed with no error
12 - Try again with 'Renew selected'
13 - Confirm it works as expected

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 763cc4eb2e)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2020-09-14 22:19:34 +00:00
Jonathan Druart 10c58c629b Bug 24663: Remove authnotrequired if set to 0
It defaults to 0 in get_template_and_user

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 79f7a3fc024323d8b4016d201a222118801bdcc6)
2020-08-31 20:03:22 +00:00
Jonathan Druart 725e605f8e Bug 26133: Remove GetMarc* calls in detail.pl
There are several calls in catalogue/detail.pl that can be removed:
GetMarcISBN, GetMarcAuthors, GetMarcSubjects, GetMarcSeries, GetMarcUrls and GetMarcHosts
They pass a variable to the template that is never used.

Test plan:
Confirm that this TT variable is never used.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 5c190388ae)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2020-08-13 18:06:29 +00:00
Owen Leonard cde498344d Bug 26070: Remove GoogleIndicTransliteration system preference
The Google Transliterate API was deprecated on May 26, 2011. This patch
removes the feature and associated system preference.

To test, apply the patch and run the database update process.

 - Go to Administration -> System preferences and search for
   'GoogleIndicTransliteration.' There should be no results.
 - Search the Koha codebase for references to
   'GoogleIndicTransliteration.' There should be no current references..

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 9b9e8fd328)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2020-08-06 20:39:07 +00:00
Didier Gautheron 549cc995b2 Bug 25982: OPAC shelves RSS link output is xml
Output rss feed as text/xml

Test plan:
1) have books entered
2) log in create a list
3) add books to list
4) display list in OPAC
5) click the RSS link button.
   -- output is displayed as html text
6) apply patch
7) repeat steps 4&5
   -- output is displayed as xml tree

Signed-off-by: Sally <sally.healey@cheshiresharedservices.gov.uk>
Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 3d0da68d5a)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2020-08-06 20:14:08 +00:00
Tomas Cohen Arazi 55a24f880d Bug 25961: Add hooks for plugins to inject variables to OPAC XSLT
This patch adds the following plugin hooks:
- opac_results_xslt_variables
- opac_detail_xslt_variables

This hooks will inject variables returned by the plugin in the form of a
hashref, into the ones that are passed to the XSLT processing code.

To test:
1. Apply the 'DO NOT PUSH' commit
2. Install the Kitchensink plugin
3. Restart all
4. Search biblios in the OPAC
=> SUCCESS: A text is injected in front of the biblio title
5. Enter the detail page of any of the results
=> SUCCESS: A text is injected in front of the biblio title
6. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 9676f537a4)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2020-07-31 21:26:51 +00:00
Jonathan Druart ddb722af26 Bug 5087: Add server-side check
If a user to access a CSV profile that is not available at the OPAC we
should redirect to 404.

It will also handle undefined csv_profiles

For instance:
kohadev.mydnsname.org:8080/cgi-bin/koha/opac-downloadshelf.pl?shelfnumber=1&format=3
kohadev.mydnsname.org:8080/cgi-bin/koha/opac-downloadcart.pl?bib_list=1/2/&format=3

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit c2d45ac0f4)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2020-07-30 17:02:57 +00:00
Tomas Cohen Arazi 54e88ebe87 Bug 5087: (QA follow-up) Fix leakage in opac-downloadshelf.pl
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit db15f4af8d)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2020-07-30 17:02:37 +00:00
Tomas Cohen Arazi 2270d92708 Bug 5087: (QA follow-up) Rename the attribute to fit later API usage
This patch renames the introduced attribute for later usage on the API,
and changes the logic to use it the other way around.

It also adds a KEY for the flag, as it will be used in WHERE statements.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 4780930720)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2020-07-30 17:01:53 +00:00
Aleisha Amohia 712143d26b Bug 5087: Ability to define whether CSV profile shows in OPAC
To test:
1) Update database
2) Update schema
3) In staff side, go to Tools -> CSV profiles
4) Make a CSV profile with profile type = MARC and usage = Export
records
5) Leave 'Show option in OPAC' unchecked and save
6) Go to OPAC and add an item to your cart
7) Click Cart, click Download, confirm that your newly created CSV
profile does not show as an option
8) Go back and edit CSV profile on staff side
9) Check the 'Show option in OPAC' checkbox and save
10) Go back to download cart in OPAC
11) Confirm the CSV profile now shows in the dropdown

Sponsored-by: Catalyst IT
Signed-off-by: Maryse Simard <maryse.simard@inlibro.com>

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit ae3644a594)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2020-07-30 17:01:08 +00:00
Owen Leonard 2fb5292dbf Bug 26005: OPAC cart display fails with error
This patch removes the "opac_option" parameter from opac-basket.pl. It
was included in Bug 25402 because the bug was dependent on 5087.

To test, apply the patch and add some items to the Cart in the OPAC.
Click the Cart button to show the cart. The pop-up window should load
correctly without errors.

Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 619d7dde80)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2020-07-25 18:04:19 +00:00
Julian Maurice b8a1515ad3 Bug 21395: Make perlcritic happy
This patch adds a .perlcriticrc (copied from qa-test-tools) and fixes
almost all perlcrictic violations according to this .perlcriticrc
The remaining violations are silenced out by appending a '## no critic'
to the offending lines. They can still be seen by using the --force
option of perlcritic
This patch also modify t/00-testcritic.t to check all Perl files using
the new .perlcriticrc.
I'm not sure if this test script is still useful as it is now equivalent
to `perlcritic --quiet .` and it looks like it is much slower
(approximatively 5 times slower on my machine)

Test plan:
1. Run `perlcritic --quiet .` from the root directory. It should output
   nothing
2. Run `perlcritic --quiet --force .`. It should output 7 errors (6
   StringyEval, 1 BarewordFileHandles)
3. Run `TEST_QA=1 prove t/00-testcritic.t`
4. Read the patch. Check that all changes make sense and do not
   introduce undesired behaviour

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit b168f4a2e9)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2020-07-13 16:44:43 +00:00
Jonathan Druart be2c5e50a7 Bug 18911: Add the ability to set the preferred lang for notice at the OPAC
Patron should be allowed to modify this setting without asking a staff
member.

The setting is not configurable and cannot be hidden via a syspref.

Test plan:
- Turn the pref TranslateNotices on
- Install some languages
- Edit your messaging settings at the OPAC
=> Notice the "Preferred language for notices" dropdown list
- Select one
=> Confirm that the value is saved in DB

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 0ab27fe6da)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2020-07-13 14:55:18 +00:00
Owen Leonard 967c930b01 Bug 25402: Put OPAC cart download options into dropdown menu
This patch modifies the process of downloading a cart so that it doesn't
involve a separate popup window.

To test, apply the patch and add some titles to the cart in the OPAC.

 - Open the cart
 - The "Download" button should now be a dropdown menu.
 - Selecting any of the download options should trigger a download
   prompt.
 - Test with and without some CSV profiles which have been configured
   for use in the OPAC

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 174ea44dcc)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2020-07-10 16:57:01 +00:00
Katrin Fischer e15992e4eb Bug 11994: OpenSearch plugins needs to be delivered with Content-Type application/opensearchdescription+xml
https://developer.mozilla.org/en-US/docs/Web/OpenSearch
Your server should serve OpenSearch plugins using
Content-Type: application/opensearchdescription+xml.

To test:
- Verify the Content-Type the file is delivered with
  is correct, for example using wget
  http://127.0.0.1:8080/cgi-bin/koha/opac-search.pl?format=opensearchdescription

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit f090c1d2cb)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2020-07-10 16:03:57 +00:00
Kyle M Hall 41ad2ba4db Bug 25769: Patron self modification triggers change request for date of birth to null
If PatronSelfModificationBorrowerUnwantedField contains dateofbirth, all
patron self modification requests will attempt to set dateofbirth to
null instead of ignoring the field.

Test Plan:
1) Add dateofbirth to PatronSelfModificationBorrowerUnwantedField
2) Run a patron self modification
3) Note the request sets dateofbirth to null on the staff side
4) Apply this patch
5) Restart all the things!
6) Run another self-modification
7) Note of the staff side that dateofbirth is unaffected

Signed-off-by: Emmi Takkinen <emmi.takkinen@outlook.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 73c421a516)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2020-07-10 15:22:32 +00:00
Jonathan Druart 9893fb4ec5 Bug 23276: Do not display tag if pref TagsEnabled is off
If the pref TagsEnabled is off we should not display the tags at the
OPAC.
There is a message to tell that tags system is disabled, but the tags
are displayed.

We should redirect to 404 like we do in opac-topissues.pl and
opac-suggestions.pl.

Test plan:
- Turn TagsEnabled on
- Add some tags
- Turn TagsEnabled off
- Hit /cgi-bin/koha/opac-tags.pl
=> Without this patch you see a warning messaging saying that the tag
system is disabled, but the tags are displayed
=> With this patch you get a 404 redirect

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 6fc316d2ee)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2020-06-17 22:35:51 +00:00
Jonathan Druart 6802d1a67e Bug 17842: Simplify the code
There is no need for all the conditions.
From Encode::encode POD:
  "If the $string is undef, then undef is returned."

Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 74c7530e3d)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2020-06-17 21:19:56 +00:00
David Cook a1a1ed902d Bug 17842: UTF-8 encode ISO2709 MARC download from cart
The cart was outputing ISO2709 MARC records with Latin-1
encoding. Records containing non-latin1 characters were
automatically re-encoded as UTF-8 by browsers, which led to
inconsistent character encodings for downloaded MARC files.

This patch explicitly encodes ISO2709 MARC characters from
the cart download as UTF-8 encoded bytes, which resolves the problem.

Test Plan:
0) Don't apply patch
1) Create bib record with only ASCII characters
2) Add a ü character to the title
3) Save bib record
4) Download bib record from cart (opac and staff client)
5) Using xxd or some other program, note that the ü is
represented by a FC byte (latin-1 encoded)
6) Apply the patch
7) Download bib record from cart (opac and staff client)
8) Using xxd or some other program, note that the ü is
represented by C3 BC bytes (utf-8 encoded)
9) Success

(Note that you could potentially use Notepad++ or some other
program to open the downloaded file and just note the encoding
that it finds. You could also try "chardetect" instead. Lots
of options for figuring out the encoding.)

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 13ec430ecc)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2020-06-17 21:13:45 +00:00
Tomas Cohen Arazi 2a216e206c
Bug 25416: Let OPAC XSLTs know if the context is an anonymous session
This patch makes use of the 'variables' parameter in XSLTParse4Display
method in the different places that it is used in the OPAC. It does by
passing this parameter with

    anonymous_session => 1|0

The value will depend on the output from get_template_and_user (i.e. if
there's a returned borrowernumber).

A special case takes place in search results, as the call to
XSLTParse4Display happens in C4::Search::searchResults. So a new
parameter 'xslt_variables' is added to it.

To test:
1. Apply the [DO NOT PUSH] patch
2. Open the OPAC in your browser
3. Try detail pages, search results, tags and lists/shelves pages with
   or without an active session
=> FAIL: It always says (somewhere) 'Anonymous session: Yes'
4. Apply this patch, restart_all
5. Repeat 3
=> SUCCESS: It will tell the Yes/No correctly regarding anonymous
sessions!
6. Sign off :-D

Sponsored-by: Universidad ORT Uruguay
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2020-05-15 09:33:22 +01:00
Nazlı Çetin 660edd0524
Bug 13547: Add item field 3 (Materials specified) to the OPAC holdings table
Test plan:

1- View a record with Materials specified (field 3) data in the opac
2- Apply patch
3- Log in to staff client
4- Home->Administration->Column Settings->OPAC->holdingst
5- Set item_materials visibility
6- Refresh OPAC page
7- Confirm that the materials specified column has been added after the
   Call number column.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2020-05-12 11:44:32 +01:00
Owen Leonard 308d67950e
Bug 13388: Add library pages to the OPAC
This patch adds a script and a template for showing library information
pages in the OPAC. A "libraries" page lists all the libraries in the
system, linking to individual pages for each library showing more
information..

If there is only one library in the system the page shows all of that
library's information.

To test, apply the patch and rebuild the OPAC CSS
(https://wiki.koha-community.org/wiki/Working_with_SCSS_in_the_OPAC_and_staff_client).

 - Go to /cgi-bin/koha/opac-library.pl in the OPAC.
 - Verify that all the correct information is displayed for the
   libraries in your system.
 - Verify that page title and breadcrumbs look correct.
 - Click to view details for a library.
   - The details page should show the full contents of
     branches.opac_info
   - A menu should show links to other libraries' detail pages.

EDIT: This revised patch adds a "Libraries" link to the links under the
search bar; Corrects encoding in the breadcrumb link; Makes the page
title more specific when viewing an individual library.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2020-05-04 09:11:03 +01:00
Owen Leonard 9776d591ec
Bug 25340: Pass biblio object to OPAC comments template
This patch modifies the OPAC comments system so that the biblio object
is passed to the template. This allows the biblio-title include to
properly access the title and subtitle information.

Unrelated change: Remove some custom CSS from the page which was
obsolete.

To test, apply the patch and make sure the "reviewson" preference is
enabled.

- Log in to the OPAC and open a bibliographic record's detail page.
- Under the "Comments" tab, click the "Post your comments" link to
  trigger the pop-up window.
- In the pop-up window, verify that the item's title is correct in the
  page title and the heading. Author should display correctly, if
  present.
- Test submitting a comment and editing a comment. Everything should
  work correctly.

Signed-off-by: Sally <sally.healey@cheshiresharedservices.gov.uk>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2020-05-04 08:53:37 +01:00
Owen Leonard d37a3576f2
Bug 25110: Allow patrons to add star ratings to titles on their summary/checkout page
This patch adds the ability for logged-in patrons to add star ratings to
titles in their list of current checkouts and on the reading history
page.

The reading history page previously only showed existing ratings. Now it
will allow the entry of ratings as well.

The JS and markup for the feature are in separate include files to
facilitate re-use. It includes markup for non-js display of ratings and
js-driven ratings controls.

To test, apply the patch and set the OpacStarRatings to all, "results,
details, and user" pages.

 - Log in to the OPAC as a user with checkouts.
 - On the "your summary" page, test the features of setting star
   ratings:
   - Any title with existing ratings should show the rating and the
     average rating number.
   - Set a rating. Confirm that it shows a message with your rating.
   - Click the "cancel rating" link, and confirm that your rating is
     removed.
   - Set a rating and reload the page. Confirm that the rating was
     saved.
   - Test the "cancel rating" link on the title you set before you
     reloaded the page. The rating should be cancelled.
 - Test the same functionality on the "your reading history" page.
 - Test these pages with the  OpacStarRatings preference set to "only
   details" or "no." The pages should function correctly.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2020-04-29 17:04:32 +01:00
Tomas Cohen Arazi 4452036d1c
Bug 25009: Avoid leakages in opac-showmarc.pl
This patch cleans opac-showmarc.pl so it doesn't allow retrieving
records from import batches without requiring any permissions in the
OPAC.

it does so by just removing the code portion that does that.

It also cleans the record fetch operation and how the record processor
is initialized to it actually works :-D

To test:
1. Perform a successful Z39.50 search in cataloguing (this fetches 20
   records usually)
2. Query your DB for a valid import_record_id:
  $ koha-mysql kohadev
  > SELECT * FROM import_records LIMIT 1;
3. Notice some of the MARCXML details (title, author, etc), and the
   import_record_id
4. Point your browser to the opac-showmarc.pl URL like this:
   http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-showmarc.pl?importid=20
=> FAIL: You get the record! (Bonus: no field/subfield takes place)
5. Hide some obvious subfield on the framework for a known (to you)
   biblionumber
6. Point your browser to:
   http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-showmarc.pl?id=<biblionumber_here>
=> FAIL: No filtering takes place
7. Apply this patch
8. Repeat 4
=> SUCCESS: You get an error because you did a bad request (no id param)
9. Repeat 6
=> SUCCESS: Subfield filtering actually works!
10. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2020-04-27 10:44:10 +01:00
Aleisha Amohia 3d022f0f27
Bug 24913: Add PatronSelfRegistrationConfirmEmail syspref
To test:
1) update database, restart memcached/plack
2) Go to Administration -> System preferences -> OPAC tab. Enable the
new PatronSelfRegistrationConfirmEmail system preference. Enable other
required self registration sysprefs.
3) Go to the OPAC home page. (You may need to log out). Click the
'Register' link so you are redirected to the member entry form.
4) Notice the 'Confirm primary email' field after the 'primary email'
field. Put 'a@a.com' in primary email, and 'b@b.com' in the confirm
field. Scroll to the end of the form and Submit.
5) Confirm the form is not successfully submitted, and an error message
is shown to indicate the email addresses do not match.
6) Confirm you cannot cut, copy or paste in either the primary email or
confirm primary email fields. Confirm the right click menu doesn't work
in these fields.

7) Disable javascript in your browser.
8) Repeat steps 3 and 4.
9) Confirm there is an error message to indicate the email addresses do
not match.

10) Re-enable javascript. Fill in the form correctly with matching email
addresses and confirm it successfully submits.

11) Disable the PatronSelfRegistrationConfirmEmail syspref.
12) Attempt to register an account on the OPAC again. Confirm the
'confirm email address' field is gone and form works as expected.
13) Re-enable the PatronSelfRegistrationConfirmEmail syspref.
14) Log in to the OPAC and go to your personal details
15) Edit the primary email field
16) Confirm you are able to submit your changes (you should not see an
error about emails not matching).

Sponsored-by: Bibliotheksservice-Zentrum Baden-Württemberg (BSZ)
Signed-off-by: holly <hc@interleaf.ie>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2020-04-21 12:30:40 +01:00
Martin Renvoize 081a4c75be
Bug 25147: (RM follow-up) Update pref references.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2020-04-17 09:03:47 +01:00
Jonathan Druart 665c8328d1
Bug 25136: Join the 2 ifs
Highlight that we only need this for action="new"

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2020-04-16 19:26:48 +01:00
Lucas Gass dbf604e141
Bug 25136: Make PatronSelfRegistrationLibraryList only effect new registration
This patch makes it so PatronSelfRegistrationLibraryList will only effect the registration from and not the modification form.
TO TEST:
1. Turn on self reg and add some libaries to PatronSelfRegistrationLibraryList.
2. Notice that the libaries that display in the borrower_branchcode dropdown are the ones you selected on both the new registration from and the modification form.
3. Apply patch.
4. Now only the new registration from should show libaries on PatronSelfRegistrationLibraryList.
5. The modifciation dropdown should still show all libraries.

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2020-04-16 19:26:14 +01:00
Jonathan Druart cc6c3f5815
Bug 25137: (bug 23084 follow-up) Fix incorrect grep ternary condition
The lack of parenthesis makes the condition evaluated wrong.

Test plan:
- confirm you have a branch with code X
- enter X in PatronSelfRegistrationLibraryList
- go to cgi-bin/koha/opac-memberentry.pl (either as a logged in patron or as a self-reg patron)
- confirm branch dropdown is not empty and contain X
- empty out PatronSelfRegistrationLibraryList
- reload cgi-bin/koha/opac-memberentry.pl and confirm branches show

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2020-04-15 08:35:04 +01:00
Nazlı Çetin 70ea3e39a8
Bug 22774: (follow-up) Limit purchase suggestion in a specified time period
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
2020-04-14 16:42:17 +01:00