Commit Graph

56229 Commits

Author SHA1 Message Date
Jonathan Druart fa84dfb770
Bug 37398: Adjust tests
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 3fe252f6a8)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-24 18:12:26 +01:00
Jonathan Druart 7eb1ed012c
Bug 37398: Do not rely on the columns names but data type instead
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit d2a6915010)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-24 18:12:25 +01:00
Lucas Gass ee18a0549d
Bug 37398: Adjust CSS for flatpickr
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 125d8ec1cf)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-24 18:12:24 +01:00
Lucas Gass 9521ce51bf
Bug 37398: Add set to today function to calendar.inc
To test:
1. Try editing some items with a empty value in the flatpickr.
2. Make sure the empty date fields get a date set to today when you click on the empty field.
3. Try a datetime field, making sure the datetime is correctly set.

Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 0d5bd311d4)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-24 18:12:24 +01:00
Lucas Gass 7e6d3f4c3f
Bug 37398: Add a unit test
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit b2f317a767)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-24 18:12:23 +01:00
Lucas Gass 2d4b406742
Bug 37398: Make sure subfield and subfield_date are defined
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit d32218fb68)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-24 18:12:22 +01:00
Lucas Gass b5e8bcbd81
Bug 37398: Adjust CSS for wrapped flatpickr
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit f049a13ef8)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-24 18:12:21 +01:00
Lucas Gass d2bfa731c8
Bug 37398: Make date and date time fields have date picker by default
To test:
1. APPLY PATCH, restart_all
2. Pick a framework, I choose BKS in k-t-d
3. Make sure that a few date and datetime fields are exposed in the editor.
4. On additem.tt a date picker should be instantiated on the date or datetime fields.
5. Make sure the date pickers work on each field.
6. If it is a datetime field you should have the option to add hours and minutes. ( datelastseen )
7. Edit the framework and remove the dateaccessioned.pl plugin from any of these date fields.
8. Even without the dateaccessioned.pl plugin a date picker should be present on the field.
9. Add the dateaccessioned.pl plugin to a non date/datetime field.
10. Make sure the dateaccessioned.pl plugin works properly on the non date/datetime field.
11. Mark one of the date/datetime fields as mandatory, make sure it still acts as mandatory.
12. Hide date/datetime from the editor, make sure it hides properly.

+----------------------+-------------+
| COLUMN_NAME          | COLUMN_TYPE |
+----------------------+-------------+
| dateaccessioned      | date        |
| replacementpricedate | date        |
| datelastborrowed     | date        |
| datelastseen         | datetime    |
| onloan               | date        |
+----------------------+-------------+

Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit aa4ee79f6e)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-24 18:12:21 +01:00
Pedro Amorim 868cfccf44
Bug 36627: (QA follow-up): Rename borrowernumber -> patron_id
To test:
$ prove t/db_dependent/api/v1/erm_counter_logs.t

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 15803e4f29)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-24 18:12:20 +01:00
Katrin Fischer b2a45e2e5f
Bug 36627: Fix typo "embeded"
A search turned up more of these in other files. Fixed as well.

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 3b86455e02)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-24 18:12:19 +01:00
Jonathan Druart 3ce6813527
Bug 36627: (follow-up) Use patron_to_html in 'Imported by' column
We don't need those 2 lines

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 5d6af90d76)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-24 18:12:19 +01:00
Pedro Amorim 891e4ef163
Bug 36627: (QA follow-up): Add missing tests
1) Apply patch
2) $ yarn api:bundle
3) $ prove t/db_dependent/Koha/ERM/EUsage/CounterLog.t
4) $ prove t/db_dependent/api/v1/erm_counter_logs.t

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 8a314ea750)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-24 18:12:18 +01:00
Pedro Amorim 685c34be80
Bug 36627: Add tests
k-t-d, from /kohadevbox/koha, run:
yarn run cypress run --spec "./t/cypress/integration/ERM/DataProviders_spec.ts"

Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 7faa42505f)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-24 18:12:17 +01:00
Pedro Amorim d9235cee09
Bug 36627: Use patron_to_html in 'Imported by' column
For consistency, and to avoid 'null koha' for a file imported by
the koha user (no first name).

Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit f70a5ffc67)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-24 18:12:17 +01:00
Matt Blenkinsop 7265603c66
Bug 36627: Rename embed method to patron
This patch renames the embed method from borrowernumber to patron to fit with the use of 'patron' in the API

Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 7b75586ead)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-24 18:12:16 +01:00
Matt Blenkinsop bd9b473567
Bug 36627: Embed patron record for display
Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit da475321a5)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-24 18:12:15 +01:00
Matt Blenkinsop aa08e30cce
Bug 36627: Record who is importing sushi data
This patch adds functionality for storing the patron (or cronjob) that triggers a harvest. Currently every counter log is stored as being imported by the cronjob

Test plan:
1) In the usage statistics module in ERM, create a data provider (the details in the provider are not important)
2) Click into the provider and click into manual upload
3) Upload the file attached to this bug
4) Once the background job is completed click into the counter logs tab in the provider. The imported by columns should show a user with a clickable link

Signed-off-by: Pedro Amorim <pedro.amorim@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 062e04c9c3)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-24 18:12:15 +01:00
Janusz Kaczmarek 7c37b128ac
Bug 38483: C4::Heading::preferred_authorities is not used
C4::Heading::preferred_authorities seems to be not used for ages (maybe
never used?)

Test plan:
$ git grep preferred_authorities
-->   should return nothing

Sponsored-by: Ignatianum University in Cracow
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Emily Lamancusa <emily.lamancusa@montgomerycountymd.gov>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 7c70b09dfc)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-24 18:12:14 +01:00
Katrin Fischer f3252871ee
Bug 38662: Fix terminology "Members" and remove unneeded sub-heading
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit f42df40680)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-24 18:12:13 +01:00
Pedro Amorim 5a9c5b4d27
Bug 38662: Remove redundant 'ERM' labels
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 2b0286889d)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-24 18:12:13 +01:00
Pedro Amorim 642021cf03
Bug 38662: Sort tables alphabetically
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 4012f805b6)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-24 18:12:12 +01:00
Pedro Amorim 9140c3e5b1
Bug 38662: Group tables by module name
Test plan:
1) Before applying patches, visit the additional fields admin page:
   <staff_url>/cgi-bin/koha/admin/additional-fields.pl
2) Notice the tables are not grouped by module, and not alphabetically sorted
3) Apply patches. Refresh

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 6a0c475bc5)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-24 18:12:11 +01:00
Pedro Amorim a14af8ed5e
Bug 36662: Move test files to the correct folder structure
Trivial leftover house-keeping from bug 35581.

Test plan:
$ prove t/db_dependent/Koha/ILL/*

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit b26b7d740f)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-24 18:11:51 +01:00
Marcel de Rooy c374c92007
Bug 37784: (QA follow-up) Add few tables to Koha::Database::Columns
This resolves exceptions like:
Invalid table name accountlines at /usr/share/koha/C4/Reports/Guided.pm line 216.

Test plan:
Go to reports/dictionary.pl
Try to add a new definition for Serials.
Without this patch, you would crash (status 500).
Run t/Koha/Database/Columns.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-24 17:59:11 +01:00
Marcel de Rooy 9dc5842b8c
Bug 37784: (QA follow-up) Bail out to new definition
The code went back to step 3 but the error message is not there.
It is easier to go back to the start: no need to fetch columns.
And this is now an exception; it will only come up when trying
malicious things.

Also turned foreach and unless forbidden around. No need to go
into the loop when we found a forbidden field.

Test plan:
See first patch. You should see the message now.

Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-24 17:59:10 +01:00
Aleisha Amohia bff29bbd45
Bug 37784: Do not show forbidden columns in reports dictionary
This patch prevents forbidden columns from being selected using the reports dictionary.

To test:

1. Go to Reports -> View dictionary
2. Choose 'new dictionary'
3. After providing a name and description, select the 'patrons' table
4. Select the 'password' column and go Next
5. Notice it is possible to see a list of all the password hashes in the 'choose' selection box when asked to specify a value

6. Apply patch and restart services

7. Repeat steps 1-3
8. Notice the 'password' column and other forbidden columns are not available to be selected

9. Open the Inspector / developer tools in your browser and find the code for the columns selection
10. Change the value of one of the options in the code to "borrowers.password". So it may end up looking like this:

<option value="borrowers.password">Card number</option>

11. Choose that option from the dropdown and click Next.
12. Confirm you are redirected back to this page and warned about the column being used.

13. Ensure tests pass t/db_dependent/Reports/Guided.t

Sponsored-by: Reserve Bank of New Zealand
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-24 17:59:09 +01:00
Jonathan Druart 608331612d
Bug 38838: Clean C4::Reports::Guided->get_columns
reports/dictionary.tt and reports/guided_reports_start.tt display a list
of the columns available using optgroup to group the columns per table.

The template code is quite ugly because of the perl structure choose in
C4::Reports::Guided->get_columns

This patch removes $cgi and the 'first' variable that were not used.
Now we have an usual structure with the table names as keys and column
info in an arrayref.

Test plan:
Create a report and a new dictionary definition.
At step 3 you should see the list of the columns.
Note that they are now identical. The list when you create a dictionary
now show the description of the columns.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit 10a41979e6)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-24 17:59:09 +01:00
David Cook a06b676a5c
Bug 31165: Scrub "Public note" field for Course Reserves
When displaying the "Public note" for Course Reserves, we scrub the HTML
using the "note" scrubber type.

Test plan:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/course_reserves/course-reserves.pl
2. Click "New course"
3. Fill in required fields
4. In staff note and public note add the following:
<script>alert('boo!')</script><p>Hello!</p>
5. Click Save

6. Click "Add reserves"
7. Add "39999000001310" to Item barcode
8. Click "Submit"
9. Fill in all required fields
10. Add the following for Staff note and Public note:
<script>alert('boo2!')</script><p>Item!</p>
11. Click "Save"

12. Go back to your course reserve
13. Note the HTML is scrubbed on "Public note"
14. Go to http://localhost:8081/cgi-bin/koha/course_reserves/course-reserves.pl
15. Note the HTML is scrubbed on "Public note"

16. Go to http://localhost:8080/cgi-bin/koha/opac-course-reserves.pl
17. Note the HTML is scrubbed on "Notes"
18. Click on your course reserves
19. Note the HTML is scrubbed on "Notes"

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-03-24 17:59:03 +01:00
Paul Derscheid 7707a62f91
Update release notes for 24.11.02 release
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-26 19:49:30 +01:00
Paul Derscheid dcd9f344b8
Increment version for 24.11.02 release
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-26 19:34:43 +01:00
Paul Derscheid 8ab34091c8
Merge remote-tracking branch 'upstream/24.11.x' into 24.11.x-security
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-26 19:24:37 +01:00
Marcel de Rooy 722c25cde0
Bug 36081: (QA follow-up) Resolve IsNotDebit exception in ArticleRequests.t
Resolve (when running ArticleRequests.t):
Exception 'Koha::Exceptions::Account::IsNotDebit' thrown 'Account line 326 is not a debit'

This occurs after switching from ArticleRequest->new to TestBuilder.
TestBuilder creates an account line that has a credit_type_code and
a debit_type_code. (This could be fixed further somewhere else.)
For now, just setting debit_id to NULL.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-24 20:43:23 +01:00
Jonathan Druart 8c5ef89980
Bug 36081: Fix some failing tests
Signed-off-by: Magnus Enger <magnus@libriotech.no>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-24 20:43:23 +01:00
Jonathan Druart d9c0df63da
Bug 36081: Mock format
Signed-off-by: Magnus Enger <magnus@libriotech.no>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-24 20:43:22 +01:00
Jonathan Druart e20810db55
Bug 36081: Force TestBuilder to generate a valid format value
Signed-off-by: Magnus Enger <magnus@libriotech.no>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-24 20:43:21 +01:00
Jonathan Druart 59a2a2c80e
Bug 36081: Use multivalue_preference
C4::Context->multivalue_preference is not used so far and split on |
However the values of "multiple" sysprefs are separated by... comma!

Let support both here.

This patch also removes silly JS code in the template.

Signed-off-by: Magnus Enger <magnus@libriotech.no>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-24 20:43:20 +01:00
Marcel de Rooy ee6abf031f
Bug 36081: Check SupportedFormats server side
Test plan:
Add article request with format via OPAC.
Run t/db_dependent/Koha/ArticleRequest.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Tests in t/db_dependent/Koha/ArticleRequest.t pass. I can add an
article request with a type. If I allow PHOTOCOPY but change the
HTML in the OPAC form so SCAN is submitted I get a nice (but
somewhat generic) error.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-24 20:43:16 +01:00
David Cook 3e0c804801
Bug 39170: Improve validation of report ID
This change improves the validation of the report ID passed by the user.

Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Create a SQL report
3. Go to /cgi-bin/koha/tools/scheduler.pl
4. Add in a Time, Date, and Email
5. Choose your report from the list
6. Click "Save"
7. Note that your report is saved

Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-24 19:30:48 +01:00
Owen Leonard 255c516764
Bug 37266: [24.11.x] patron_lists/delete.pl should have CSRF protection
This patch adds CSRF protection to patron list deletions.

Also changed: The "Delete selected lists" button is now in a floating
toolbar.

To test, apply the patch and go to Tools -> Patron lists.

- If necessary, create a few patron lists.
- Test the two methods for list deletion available on the page:
  - Check one or more checkboxes and then click the "Delete selected
    lists" at the top of the page.
  - Click the "Actions" button for an individual list and choose "Delete
    list."
- Open the checkout page for a patron.
  - Under the "Patron lists" tab, add the patron to a list.
  - Click the "Actions" button for an that list and choose "Delete
    list."
  - When you are taken to the patron lists page the list should have
    been deleted.
- Perform the same test on the patron details page.

Sponsored-by: Athens County Public Libraries
Signed-off-by: Phil Ringnalda <phil@chetcolibrary.org>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-24 19:30:42 +01:00
David Cook d8ed07594f
Bug 38469: Replace single quotes with double quotes to prevent XSS
This change replaces single quotes with double quotes to prevent XSS
for particular operations on the circ returns page.

Test plan:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/circ/returns.pl?print_slip=1&reserve_id=1
2. Note that a pring slip is generated
(you may need to allow popups)

3. To test the XSS is patched, try the proof-of-concept from the
bug report

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-18 19:17:21 +01:00
David Cook 6d2b0c4a28
Bug 38488: Add Template::Toolkit filter for C4::Scrubber
This change adds a Template::Toolkit filter which is invoked
via " | scrub_html type => 'note' ".

Test plan:
0. Apply the patch
1. prove t/Koha/Plugins/HtmlScrubber.t

Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-18 19:17:20 +01:00
Phil Ringnalda 70781686fd
Bug 38961: XSS in vendor search
acqui/booksellers.tt and admin/currency.tt use | $HtmlTags without first
filtering the string they wrap.

Test plan:
1. Without the patch, load the URL in comment 1, note the alert()
2. Apply patch, load the URL in comment 1, no alert()

Sponsored-by: Chetco Community Public Library
Signed-off-by: Magnus Enger <magnus@libriotech.no>
Followed the test plan, works as advertised.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-18 19:17:20 +01:00
Tomas Cohen Arazi 937a412362
Bug 28478: Make opac-*detail.pl scripts use Koha::Biblio->opac_suppressed()
This patch makes the following scripts use the new method for checking
suppression:

* opac/opac-ISBDdetail.pl
* opac/opac-MARCdetail.pl
* opac/opac-detail.pl

In the `opac-detail.pl` case, it is a simple change by removing MARC
data traversal in favor of the new method. The code checking
suppression gets moved up so we don't process or make any other
calculations if the record is suppressed.

The other two scripts where completely missing the check and thus
leaking suppressed records.

To test:
1. Pick two records, one marked as suppressed, and the other not
   suppressed.
2. Try acessing them in the OPAC detail page.
=> SUCCESS: Suppressed records are suppressed, and not suppressed ones
are not.
3. Try the same records on the ISBD and MARC view
=> FAIL: They are not suppressed!
4. Apply this patch
5. Repeat 2
=> SUCCESS: Suppression is still respected
6. Repeat 3
=> SUCCESS: Suppression is respected on the ISBD and MARC views
7. Sign off :-D

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Works as advertised. Remember to activate OPAC suppression with
OpacSuppression.
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-18 19:17:20 +01:00
Tomas Cohen Arazi 2e0bcc4191
Bug 28478: Add Koha::Biblio->opac_suppressed()
This patch adds a convenient method at the Koha::Biblio level, as a
wrapper for the extrator added on this bug. Following the established
pattern we adopted a while back.

To test:
1. Apply this patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/Koha/Biblio.t
=> SUCCESS: Tests pass! All use cases covered!
3. Sign off :-D

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-18 19:17:20 +01:00
Tomas Cohen Arazi b503cfe2be
Bug 28478: Add get_opac_suppression extractor
This patch adds an extractor method for the historically hardcoded field
942$n. This way we have a single place in which we code the extraction
and sanitization of its value.

To test:
1. Apply this patch
2. Run:
   $ ktd --shell
  k$ prove t/db_dependent/Koha/Biblio/Metadata/Extractor/MARC.t
=> SUCCESS: Tests pass! All use cases are covered!
3. Sign off :-D

Signed-off-by: Magnus Enger <magnus@libriotech.no>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-18 19:17:20 +01:00
Marcel de Rooy 538005a28c
Bug 37816: (QA follow-up) Avoid repetition, typo and pipe test
Combining three regexes into one. Typo replcing.
Adding a test with pipe in pwd.

Test plan:
Run t/SIP/Sip.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-18 19:17:20 +01:00
Magnus Enger 8e2c03cc20
Bug 37816: Stop SIP2 from logging passwords
Koha's SIP2 server does a lot of logging, including all incoming
requests, in full. This means that passwords are logged, both for
the user the SIP2 client uses for logging into Koha, as well as
for the end users who provide a password to e.g. check something
out. This patch replaces passwords with three asterisks in
log strings, before they are written to the log.

To test, in ktd:
- Run the new tests:
  $ prove t/db_dependent/SIP/Sip.t
- Tail the SIP2 logs:
  $ sudo tail -f /var/log/koha/kohadev/sip*.log
- Telnet into the SIP2 server:
  $ telnet localhost 6001
- Try logging in by pasting this into the telnet session:
  "9300CNterm1|COmypassword|CPCPL|"
- Verify that "mypassword" is replaced by "***" in the logs
- Try different values for the password, including the correct password
  which is "term1" in ktd
- Try other SIP2 messages that include password fields (AC, AD, CO)

Update 2024-12-03: Fix issues pointed out by QA.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-18 19:17:19 +01:00
Julian Maurice 551ab16e1f
Bug 38454: Flush memory cache before every API request
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-18 19:17:19 +01:00
Phil Ringnalda 8a66a7edb8
Bug 38467: (follow-up) Update cpanfile
For use_rfc3986() to work, we need at least Template::Toolkit 2.27.

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-18 19:17:19 +01:00
Phil Ringnalda b9f8a947da
Bug 38467: (follow-up) Fix test
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-02-18 19:17:19 +01:00