If a second login on top of a current session fails on
permissions, we should not grant access without context.
Test plan:
[1] Run t/db../Auth.t, it should pass now.
[2] Test interface with/without this patch:
Pick two users: A has perms, B has not.
Put two staff login forms in two tabs.
Login as A in tab1. Login as B in tab2.
Without this patch, B gets in and crashes.
With this patch, B does not get in ('no perms').
Bonus: Go to opac if on same domain. You are still
logged in as B.
NOTE: I added a FIXME here, since you could argue about filling
the session info or otoh deleting the session. We present an
authorization failure; people may not realize that they are
still logged in (see test plan - bonus).
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
Test plan:
Without follow-up patch, Auth.t should fail:
not ok 5 - No permission response
not ok 6 - checkauth returned failure
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
Somewhere the line undef $userid got removed.
We need it to resolve the second login situation.
Test plan:
Login in staff with user missing privileges.
On the login form login again with another staff user.
Note that you do no longer crash.
Run t/db../Auth.t
Run t/db../Koha/Auth/TwoFactorAuth.t
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
Test plan:
Without next patch, run Auth.t.
Should fail now before next patch resolves problem:
not ok 2 - Login of patron2 approved
ok 3 - Did not return previous session ID
not ok 4 - New session ID not empty
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
No change in user experience. But since we can mock safe_exit,
we can enhance test results.
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
This patch defaults to using "email" rather than "sms" notices
when AutoRenewalNotices is set to use the --send-notices cron switch
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 88f63e01d2)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 681730ee1a)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
(cherry picked from commit dc92b692e2)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Following bug 18532, one can set a patron's messaging prefs to deliver an auto-renew notice via SMS.
However, the auto_renewals cron only knows how to generate email notices. We should not allow the selection of non-functional transport types.
Test Plan:
1 - Set pref AutoRenewalNotices - 'according to patron messaging preferences'
2 - Set circ rule with:
Loan period: 5 days
No renewal before: 5
AutoRenewal: Yes
Renewals allowed: 5
3 - Set SMS Send driver to Email
4 - Find a patron and set them to receive auto renewal notices via SMS and no other transport
5 - Provide a proivder and sms number for the patron
6 - Checkout an item to the patron, set due date to yesterday
7 - Run auto renewals:
perl misc/cronjobs/automatic_renewals.pl -v --send-notices -c
8 - Item renewed, no message sent
9 - Check in item, checkout again due yesterday
10 - Apply patch
11 - Browse to Tools->notices and slips
12 - Edit AUTO_RENEWALS and AUTO_RENEWALS_DIGEST to copy email template to sms and add a title
13 - perl misc/cronjobs/automatic_renewals.pl -v --send-notices -c
14 - Item renewed, confirm patron has a notice in their account
15 - Check the digest option, check in item, checkout again as due, repeat cronjob and note digest notic
16 - sign off
https://bugs.koha-community.org/show_bug.cgi?id=30355
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit fef29151e0)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit e672ea6892)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
(cherry picked from commit ff27eecd56)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
The OPAC was originally featured a search results facets box that would
collapse at narrower browser widths and show a "Refine your search" link
under the breadcrumbs menu. At some point this broke, with the "Refine
your search" link appearing at the bottom instead.
This patch revises the page to restore the previous behavior.
To test, apply the patch and rebuild the OPAC CSS
(https://wiki.koha-community.org/wiki/Working_with_SCSS_in_the_OPAC_and_staff_client).
- Perform catalog search in the OPAC which will return multiple results.
- View the page at various browser widths. At narrower widths the facets
menu should appear as a "collapsed" box with a "Refine your search"
link.
- Clicking the link should toggle the facets menu visibility.
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 915815ddae)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
(cherry picked from commit 2e72aae7e4)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
We are sanitizing other attributes but "extended patron attributes".
Test plan:
Make a patron attribute editable at the OPAC
Edit an existing patron, or register a new one
Use a script tag in the new value ("<script>alert("booh!")</script>" for
instance)
With this patch the value is remove if containing an HTML tag that is
not br b i em big small strong (see C4::Scrubber)
Signed-off-by: Mark Hofstetter <koha@trust-box.at>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit ddaa78bdab)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
this patch reduces the required version of 'Locale::XGettext::TT2' to 0.6
version 0.7 of of Locale::XGettext::TT2 is incompatible with the current version of libintl-perl (1.26), so we use 0.6 instead
https://packages.debian.org/stretch/libintl-perlhttps://metacpan.org/release/GUIDO/Template-Plugin-Gettext-0.6/view/lib/Locale/XGettext/TT2.pm
we will move to 'Locale::XGettext::TT2' 0.7 when libintl-perl-1.32 arrives
https://tracker.debian.org/pkg/libintl-perl
small change, no test plan
Signed-off-by: Mason James <mtj@kohaaloha.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 6c49c489d6)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
This patch fixes the broken commit_file.pl script.
It doesn't deal with commiting the import from the UI.
To test:
1. Pick a file for staging:
$ kshell
k$ misc/stage_file.pl --file TestDataImportKoha.mrc
=> SUCCESS: All good
2. Commit!
k$ misc/commit_file.pl --batch-number 1
=> FAIL: You see
DBIx::Class::Storage::DBI::_exec_txn_begin(): DBI Exception: DBD::mysql::db begin_work failed: Already in a transaction at /kohadevbox/koha/C4/Biblio.pm line 303
3. Apply this patch
4. Repeat 2
=> SUCCESS: Commit succeeds
5. Sign off :-D
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Bug 29325: (QA follow-up) Remove unexisting parameters of BatchRevertRecords
There is no interval and callback as in BatchCommitRecords.
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Bug 29325: Call progress callback one last time to confirm comppletion
Previously after finishing the loop we were still in a transaction that never completed - we should report progress when done
one final time to commit the last records
To test:
1 - Stage a file with > 100 records
2 - Commit file
3 - Confirm batch is imported and no records left as staged
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Bug 29325: Fix import from staff client
same test as before, but via the staff client
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Bug 29325: Handle the transaction in BatchCommitRecords
Requiring the callback to commit was breaking reversion, and likely elsewhere
Let's simplify and say that the routine iteself will handle the txn and commit
TO test:
1 - Stage a file
2 - Import a file
3 - Revert a file
4 - Test staff client and command line
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Bug 29325: (QA follow-up) Tidy up
tools/manage-marc-import.pl: sub commit_batch does no longer need $schema
tools/manage-marc-import.pl: sub revert_batch: calling BatchRevertRecords which has no interval and callback
misc/commit_file.pl: sub print_progress_and_commit does no longer commit, renamed
misc/commit_file.pl: sub print_progress does no longer have a schema parameter
misc/commit_file.pl: sub revert_batch reported deleted items as added
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
(cherry picked from commit 514b662861)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Test plan:
(A) Reproduce the bug:
A1 In Administration > System preferences > Web services:
- Enable OAI-PMH
- Enable OAI-PMH:AutoUpdateSets
- Enable OAI-PMH:AutoUpdateSetsEmbedItemData
A2 In Tools > Export data > Export bibliographic records, export 1 (one)
biblio record. Be sure that this biblio record has at least one item.
Don't tick "Don't export items".
A3 Delete the exported biblio record, and its items.
A4 In command line, on the server load the exported file:
./bulkmarcimport.pl -b -v -file /path/to/koha.mrc
A5 Retrieve the biblio record in Koha. Note the absence of the item(s). This is
the bug.
(B) Apply the patch
B1 Delete the record (without item) loaded at A4.
B2 In command line, on the server load the exported file:
./bulkmarcimport.pl -b -v -file /path/to/koha.mrc
B2 Retrieve the biblio record in Koha. Note the presence of the item(s).
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit d5e65dd4c0)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 06b48f16e4)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
(cherry picked from commit 084c14787f)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
DataTables is not raising error to the end user, it's only displaying a generic message in the console.
This leads to lot of questions on IRC or the mailing list ("the table is empty").
We can do better and display what went wrong.
We could also imagine add a link to the wiki for the more common problems (won't be implemented here however).
Test plan:
Revert "Bug 31104: Put each link on a separate header" and search for a
patron using a very long string
You should get an alert with the reponse of the server.
In my case:
"""
Something went wrong when loading the table.
414: Request-URI Too Long
"""
You can also make the REST API returns a 500 (bad specs or simply with a
die statement).
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 76b984bb6c)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 7a5d048b51)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
(cherry picked from commit 6ac8f34e99)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
The header rows still showed \t because the newly defined
variable wasn't used there.
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 2eea061ca3)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit ed114537d3)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
(cherry picked from commit 6c47479066)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
This patch corrects the export of the 2 other reports
using CSV profiles:
* Late issues (serials)
* Basket (acquisitions)
To test:
1) Late issues
* Update the late issues sample report to use tab as separator
* Create a subscription
* Go to serial collection and 'generate next' to get some late issues
* Go to Claims
* Export the late issues and verify format is correct
* Verify exported file has tabs
2) Basket summary
* Create an order with several order lines
* Create an SQL type CSV profile for basket export using tab as separator
Example: aqorders.quantity|aqordres.listprice|Title=biblio.title
* Export the basket using your configured CSV profile
* Verify exported file has tabs
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 7cd84171ab)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 9af01ea2e3)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
(cherry picked from commit cdfecb6fb7)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
When choosing tabulation as the delimiter for a CSV profile
for the lost item report, the tabs appear in the file as \t
instead of as proper tabs.
title\tauthor\tstocknumber\tcallnumber
"E Street shuffle :"\"Heylin, Clinton."\\
To test:
* Upate the existing sample lost item CSV profile to use tabs as
separator
* Make sure you have some lost items in your database or create some
* Go to Reports > Lost items
* Run the report
* Check all or some of the checkboxes in the result list
* Export using the link on top and the CSV profile
* Verify the tabs are not exported correctly
* Apply patch
* Verify tabs now are proper tabs instead of \t
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 983965ee47)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 4db8368fd5)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
(cherry picked from commit becbc5bec1)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
This patch simply removes a discrepancty where when a discount is provided on the order form
we add the discount to the price, and when it comes form the vendor we subtract the discount.
Discounts should always descrease the estimated cost
To test:
0 - Have a vendor with a discount of 10% specified
1 - Export a record from your Koha
2 - Stage the record for import and match on biblionumber
3 - Add to a basket in acq from the staged file
4 - Select the title, and set order price to $10 and do not fill the discount field
5 - Add the order - note $10 RRP and $9 actual/budgeted cost
6 - Repeat 2&3
7 - Select the tile, set price $10 and discount 50%
8 - Add the order - note $20 RRP and $10 actual/budgeted cost! FAIL
9 - Apply patch, restart all
10 - Repeat 2-7
11 - Add the order, note $10 RRP and $5 actual.budgeted cost
Signed-off-by: Kelly McElligott <kelly@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 7c734c6903)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 96eed0f5e0)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
(cherry picked from commit da1633125f)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
This patch updates the svc/renew api endpoint to allow seen renewals
when appropriate
Signed-off-by: Caroline <caroline.cyr-la-rose@inlibro.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit e3311ebffc)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit e9153d7f15)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
(cherry picked from commit e20d79123b)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
This patch updates the javascript for the checkouts table to add the
checkbox back in for the case where too_unseen is the error returned by
CanBookBeRenewed, allowing such issues to be renewed.
Signed-off-by: Caroline <caroline.cyr-la-rose@inlibro.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit 91a67e3c8a)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 36e39cab65)
Signed-off-by: Arthur Suzuki <arthur.suzuki@biblibre.com>
(cherry picked from commit b513d0b038)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
There's been a behavior change in recent MariaDB that made some cases
deal with truncated data in DOUBLE context instead of DECIMAL.
Probably this:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27380
This made the affected test fail consistently on those versions.
This trick for checking OpacHiddenItems is correct (as introduced on bug
28125 doesn't really make use of the warning, just prints it in
about.pl) so one option was to just check for a warning.
I decided to keep the test, but add the optional DECIMAL|DOUBLE check on
the qr. This way other eventual changes will make it fail and serve as a
warning in case something more relevant changes.
To test:
1. Apply this patch
2. Run:
$ kshell
k$ t/db_dependent/Koha/Items.t
=> SUCCESS: Tests pass!
3. Sign off :-D
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
In Elasticsearch 7 hits.total is now an object which is not always an exact
value. You can always get an exact total by adding a track_total_hits
parameter set to true when using the Elasticsearch search method
To test:
1) Run prove t/db_dependent/Koha/SearchEngine/Elasticsearch/Search.t
2) If you observe an error about types, apply patch for bug 25669
3) Run prove t/db_dependent/Koha/SearchEngine/Elasticsearch/Search.t
4) Observe that tests with count fail
5) Apply patch
6) Observe that tests with count pass
7) Sign off
Sponsored-by: Lund University Library
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 301ed1567b)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Wainui Witika-Park
Koha translators
Marcel de Rooy
Jonathan Druart
Victor Grousset/tuxayo
David Cook
Kyle M Hall
Owen Leonard
Mason James
Tomas Cohen Arazi
Frédéric Demians
Katrin Fischer
Nick Clemens
Martin Renvoize
Kevin Carnes