Commit Graph

2729 Commits

Author SHA1 Message Date
Jonathan Druart 2d938704ab
Bug 41558: Fix and standardize links to tab on opac-user
We have different implemented solution to select a tab on opac-user:
* a "tab" variable (from bug 37972), it's never used
* several variables passed from the controller to the template, depending on the tab to select (it works and is used)
* use of anchors (it does not work and is used)

We should fix and standardize it.

I've linked to several reports that seem to conflict with each others.

This patch suggests to have a "tab" variable

Test plan:
Confirm that the different links to tab to opac-user are not using a
query parameter to pass the tab to select, e.g. from the opac-main page.

Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-05-23 15:58:46 -04:00
David Cook e66a8bb617
Bug 41261: RMaint patch for 25.05.x-security
This change adds data validation to the "unapi" API endpoint.

Test plan:
0. Apply the patch
1. Go to http://localhost:8080/cgi-bin/koha/unapi
2. Note the 400 HTTP response code
3. Go to http://localhost:8080/cgi-bin/koha/unapi?id=bad
4. Note the 400 HTTP response code
5. Go to http://localhost:8080/cgi-bin/koha/unapi?id=koha:biblionumber:1&format=bad
6. Note the XML response listing the available formats for that ID
7. Go to http://localhost:8080//cgi-bin/koha/unapi?id=koha:biblionumber:1
8. Note the XML response listing the available formats for that ID
9. Go to http://localhost:8080//cgi-bin/koha/unapi?format=mods
10. Note the 400 HTTP response code
11. Go to http://localhost:8080//cgi-bin/koha/unapi?id=koha:biblionumber:1&format=mods
12. Note the MODS format returned for biblionumber 1

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-04-21 12:02:45 -06:00
Hammat Wele 40ae10bed9
Bug 41655: Local OPAC covers are not displayed in OPAC lists
Local cover images are no longer displayed in OPAC lists since Bug 41078.
In Koha versions prior to 25.05.05, local cover images were correctly displayed in OPAC lists.

This appears to be a regression.

To reproduce

1. Set the system preferences LocalCoverImages and OPACLocalCoverImages to Show.

2. Find a bibliographic record and open the record detail page.

3. Upload a local cover image file for the record.

4. Create a public list and add the record to the list.

5. In the OPAC, open the public list.
   --> The local cover image is missing.

6. Apply the patch.

7. Reload the OPAC list page.
   --> The local cover image is now displayed correctly.

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-04-01 16:41:32 -04:00
Pedro Amorim a19a6cf1ef
Bug 41237: (QA follow-up): Utilize available logged in user object
Instead of re-fetching the patron object.

This also adjusts tests:
prove t/db_dependent/Koha/ILL/Requests.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-02-27 11:55:14 -05:00
Pedro Amorim 5485218dfd
Bug 41237: Update fetch of patron's branchcode to search additional_contents by
Signed-off-by: Stephen Graham <s.graham4@herts.ac.uk>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-02-27 11:55:13 -05:00
Lucas Gass 701789978d
Bug 41076: [25.05.x] Adjust perl tidiness
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-02-24 08:35:34 -07:00
David Cook c4cd2d02a2
Bug 18148: Make list of lists in OPAC sortable
This patch adds sorting to lists of lists in the OPAC.

The mechanism used here for op=list is similar to the one
used in op=view, so it's stylistically and functionally
consistent with the rest of the Lists module in the OPAC.

Test plan:
0. Apply the patch and restart Plack (ie koha-plack --restart kohadev)
1. Create 20+ public lists and 20+ private lists for a particular user
you control (try to use names that range throughout the alphabet)
2. Using SQL, update the Modification date for at least 1 public
list and 1 private list
3. As an anonymous (ie not logged in user), go to
/cgi-bin/koha/opac-shelves.pl?op=list&public=0
4. Note you cannot see any lists
5. Go to http://localhost:8080/cgi-bin/koha/opac-shelves.pl?op=list&public=1
6, Note you can see public lists with a toolbar with the button "Sort"
below the alert "Log in to create a new list"
7. Using the "Sort" option, try out all the different sort options
for default, "List name", and "Modification date"
8. After sorting, try paging through the list of lists. You should
note that the sorting is retained through the paging.
9. prove t/db_dependent/Virtualshelves.t
10. Celebrate!

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com>
2026-02-17 17:37:31 +00:00
David Cook 46e7866132
Bug 41662: Prevent CSRF on opac-patron-consent.pl
This change prevents CSRF on opac-patron-consent.pl by
adding checking of the "op".

Test plan:
0. Apply the patch and koha-plack --restart kohadev
1. Set system preference PrivacyPolicyConsent to "permissive"
2. Log into the OPAC and go to this path:
/cgi-bin/koha/opac-patron-consent.pl?check_GDPR_PROCESSING=1
3. Note that it doesn't change the consent
4. Go to this path:
/cgi-bin/koha/opac-patron-consent.pl?check_GDPR_PROCESSING=0
5. Note that it doesn't change the consent
6. Click the "Yes" radio button and click "Save"
7. Note it changes the consent to Yes
8. Click the "No" radio button and click "Save"
9. Note it changes the consent to No

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
2026-01-29 07:47:34 -07:00
Tomás Cohen Arazi 4351b52ab7
Bug 40163: (follow-up) Fix wrong GNU links and update test
Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
2026-01-07 14:32:37 +00:00
Tomas Cohen Arazi 1cf93e5f97
Bug 40163: Fix several http addresses in the code docs
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Brendan Lawlor <blawlor@clamsnet.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
2026-01-07 14:32:30 +00:00
Marcel de Rooy b175e80f8c
Bug 28146: Respect ReplytoDefault in error pages
Test plan:
Fill ReplytoDefault.
Check an error page on OPAC and intranet.
Verify that the send mail link refers to that email address.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
2026-01-05 16:51:17 +00:00
Pedro Amorim c49069606b
Bug 41057: Return 404 if creating backend is not an OPAC backend
Test plan, ktd:
1) Enable ILLModule
2) Install an additional backend plugin e.g. 'RapidILL':
  https://github.com/openfifth/koha-ill-rapidill/releases/tag/v2.2.5
3) Restart plack if you have to:
$ koha-plack --restart kohadev
4) Edit the ILLOpacbackends system preference to just 'Standard'.
5) Now, attempt to create a request with the installed backend directly:
  <opac_url>/cgi-bin/koha/opac-illrequests.pl?op=add_form&backend=RapidILL
6) Notice the form is shown. It shouldn't be, as the only OPAC back is Standard.
7) Apply patch. Repeat. You get a 404.

Signed-off-by: Nial Halford-Busby <n.halford-busby@lboro.ac.uk>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 2d063d00d5)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-29 10:02:36 +01:00
Nick Clemens ff97e43d79
Bug 34596: Add rebuild queue where needed for existing calls to AddReturn
Existing calls to AddReturn:

C4/Circulation.pm
 - transferbook - calls ModDateLastSeen, queue is rebuilt
 - AddIssue - rebuild not needed, book is going out again immediately

C4/SIP/ILS/Transaction/Checkin.pm
 - do_checkin - added

Koha/Checkouts.pm
 - automatic_checkin - added

circ/circulation.pl
 - called in stats checkout, not needed

circ/returns.pl
 - added

opac/sci/sci-main.pl
- added

svc/checkin
 - added

svc/recall
 - wasn't actually called, removed the use statement

tools/inventory.pl
 - added

Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 18fba45afd)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-29 10:02:24 +01:00
Marcel de Rooy 79c93d7a3d
Bug 40929: Add $hold test in opac-modrequest
Test plan:
Login at OPAC.
Pass an unexisting reserve_id in a opac-modrequest.pl URL.
Verify that you get a 403 redirect.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 013a469b45)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-10-23 23:06:45 +02:00
Marcel de Rooy 8198f36473
Bug 40585: Check on Biblios->find in addbybiblionumber scripts
Just jumping to the next biblionumber (and adding found biblio recs) is
more user friendly than crashing without any further clarification to
the user.
Note that this should be a rare exception when the URL is not manipulated
(someone deleting a biblio while another wants to add it to a list).
For another bug: The template is not designed to handle the situation that
no biblio is found at all.

Test plan:
Select a biblio to add to a list and add a not-existent biblionumber
to the URL.
Without this patch, that URL will crash. With this patch, it will
silently ignore a wrong biblionumber.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 60b1cf95c4)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-25 16:22:50 +02:00
Tomas Cohen Arazi b7611013b1
Bug 40275: Use Koha::Patrons->find_by_identifier in the codebase
Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit cd4e1da3ec)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-20 10:43:37 +02:00
Martin Renvoize 3cb8cccf7e
Bug 9762: (Alternative) Log circulation overrides
An alternative approach to the original submission for bug 9762. Instead
of recording a distinct action log line for a set of override messages
in addition to the standard issue record, this patch updates the
existing issue log to include any confirmation or impossible responses
from the preceeding CanBookBeIssued call.

We continue to record these as a JSON structure as the prior patch did,
but instead of human messages we use the predefined codes as returned
from the existing CanBookBeIssued response.

To test:

After each step, a single action log message should be displayed under
`Tools > Log viewer`. The message itself will now consist of a JSON
string with an array of 'confirmations' and 'forced' strings
representing the overriden feedback from CanBookBeIssued.

Circulation -- Checking out

1) Check out an item that is age-restricted (AgeRestrictionOverride syspref)
2) Check out an item that has a “not for loan” status (AllowNotForLoanOverride
   syspref)
3) Check out an item that has a “lost” status (IssueLostItem syspref)
4) Check out an item to a patron who has reached the checkout limit
   (AllowTooManyOverride syspref)
5) Check out an item to a patron who is not allowed to borrow this item type
6) Check out an item to a patron who has unpaid fines (AllFinesNeedOverride
   and/or AllowFineOverride + noissuescharge sysprefs)
7) Check out an item on hold for someone else
8) Check out an item on hold ready for pickup by someone else
9) Check out an item already checked out to someone else
   (AutoReturnCheckedOutItems syspref)
10) Check out to a patron who has restrictions

Circulation -- Checking in

11) Ignore a hold upon check in
12) Ignore a hold and transfer upon check in

Circulation – Renewing

13) Renew an item on hold for someone else
    (AllowRenewalOnHoldOverride syspref)
14) Renew an item that has reached the maximum number of renewals
    (AllowRenewalLimitOverride syspref)

Holds

15) Place a hold for a patron who is not allowed to place this item
    type on hold (AllowHoldPolicyOverride syspref)
16) Place a hold for a patron who has reached the maximum number of
    holds
17) Place an item-level hold when rules dictate that this is not
    allowed

Sponsored-by: OpenFifth <https://openfifth.co.uk/>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 5350a9276e)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-09-20 10:43:25 +02:00
Pedro Amorim d165bfd019
Bug 40075: Only show pickup_location libraries in OPAC
And list alphabetically on branchname

Signed-off by: Chris Rowlands <chris.rowlands6@nhs.net>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 9657c19608)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-22 09:48:34 +02:00
Eric Garcia 706830d120
Bug 40143: Added links to private lists in bibliographic record detail page in OPAC
Test Plan:
1. In OPAC create a public list, add a book to the list.
2. Notice a link to the list on the biblio's detail page.
3. Create a private list and add the book to it. Notice there is no link to the list in the details page.
4. Apply patch, restart_all
5. Notice there is now a link to the private list

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 9517a57ee2)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-08-22 09:48:16 +02:00
Jonathan Druart bc11cfea77
Bug 38102: Fix default sort order
DBIx::Class::Storage::DBI::_dbh_execute(): DBI Exception:
DBD::mysql::st execute failed: Unknown column 'date_due desc' in 'order
clause' at /kohadevbox/koha/Koha/Objects.pm line 401

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit bb71c19635)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-07-24 10:23:33 +02:00
Jonathan Druart ef5e67a6ce
Bug 38102: Fix limit to 50 items in the checkout history - OPAC
Checkout history does not limit to 50 items, it's a regression from bug
33949.

To limit to 50 items we need to use "rows", not "limit".

Test plan:
Have more than 50 checkouts and confirm that by default the table only
displays 50 entries.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit dd28d473cd)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-07-24 10:23:32 +02:00
Lucas Gass faf0af11d2
Revert "Bug 36586: Define self-checkin timer using Javascript class"
This reverts commit ff403dcfb3.

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit a827e5dbe3)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-07-10 22:47:42 +02:00
PhilipOrr 035766fefa
Bug 39498: Correct patron restrictions displays
This patch updates the way patron restrictions are displayed in the OPAC
and staff interface, with the intention of making the details of each
restriction more clear. In the OPAC, a new include file is created to be
reused on the holds page and the user summary page. opac-user.pl is
updated to allow a parameter to be passed to automatically open the
"Overdues" tab.

Test plan:
1. Before applying the patch, check how the display is currently. First
   set syspref PatronRestrictionTypes to "Allow"
2. Add two different new restriction types, fill out both "Code" and
   "Label"
3. Go to a patron's checkout page and add one of each of these
   restrictions, but do not fill out the comment field when adding them!
4. Observe that in the checkouts page and details page of the patron, it
   just says "Restricted since..." and does not show the restriction
   types.
5. Add another restriction, this time fill out the comment field
6. Observe that now in checkout and detail pages, the labels from the
   restriction types are listed and the comment shown.
7. Apply patch
8. Go to patron's details and checkout pages and check the restrictions
   are now displayed correctly, that is the text "with the explanation"
   is only shown for the restrictions that actually have a comment
   8b. Log in to the OPAC with that patron and check they are displayed
       correctly in their summary page and when the patron is trying to
       place a hold.
9. Go to a different patron's account and add a restriction without a
   comment
10. Check it is now displayed correctly
11. Add more restrictions and check they are displayed correctly. Also
    add an OVERDUES restriction:
    11a. Find a patron with an overdue item checked out (or create an
         overdue checkout on a patron's account)
    11b. Go to Tools -> Overdue notice/status triggers
    11c. Set up a rule for that patron's category, e.g. "First" ->
         Delay: 1, make sure to mark the check box for "Restrict" and
         "Print"
    11d. Run misc/cronjobs/overdue_notices.pl
    11e. That patron should now also have an OVERDUES restriction
12. Turn PatronRestrictionTypes off again and check the patrons if
    everything is still displayed correctly
13. Go to another different patron and add a restriction with no
    comment, check if it is displayed correctly
14. Add another restriction with a comment and check it is displayed
    correctly
15. Log in to the OPAC with the patron that had OVERDUES restriction and
    check they are displayed correctly in their summary page and when
    the patron is trying to place a hold.
16. Same thing for the other patron without the OVERDUES restriction.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 9516fe517c)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-07-10 22:47:14 +02:00
Tomas Cohen Arazi f37a09c2e4
Bug 40101: Make opac-reserve.pl use `$patron->can_place_holds()`
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Kristi Krueger <kkrueger@cuyahogalibrary.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 33032f99a8)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-07-10 22:47:14 +02:00
Andreas Jonsson c3a9ef0989
Bug 38974: Fix error in OPAC patron update
Test plan:

1) Make sure Patron category is checked in the system preference PatronSelfModificationBorrowerUnwantedField
2) Log in to the opac
3) Go to "Personal details"
4) Select any value for "Date of birth"
5) Click save
6) This must not yield error 500. (But may be a successful save or a validation error).

Signed-off-by: David Nind <david@davidnind.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 04ebdd4ac1)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-06-22 23:48:37 +02:00
Jonathan Druart 83a96dd270
Bug 39834: Replace some tabs with spaces
In order to remove false positives with the QA script we should replace some tabs with spaces.

There are more but I wanted to make sure no regression would be
introduced

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 492e6814a1)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
2025-06-17 21:42:59 +02:00
Matt Blenkinsop 84076d5169
Bug 30301: Update templates
Signed-off-by: Hanna Leiker <tech.hanna@salinapublic.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-19 18:54:30 +02:00
Baptiste Wojtkowski e398743e06
Bug 39148: Correct sort by publicationdate in OPAC lists
Test plan (UNIMARC):
1 - Create a list with different publicationdates, chose to sort it by
  copyright gate
2 - Go to the list in the OPAC -> it is not correctly sorted
3 - Pick sort order: copyright date -> not correctly sorted
4 - Apply patch
5 - Retry 2&3 and see it works

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-12 18:31:23 +02:00
Fridolin Somers cef1685925
Bug 39737: Obsolete call on system preference 'PatronSelfRegistrationAdditionalInstructions'
Bug 34889 moved to additional contents.
Remove call in opac pages.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-12 18:31:22 +02:00
Fridolin Somers a210683610
Bug 39736: Remove obsolete call on system preference 'OPACResultsSidebar'
Bug 34869 moved additional contents.
Remove call in opac/opac-search.pl

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-12 18:31:22 +02:00
Alexander Blanchard 1f6e2c8f3c
Bug 39579: Restrict Patron Self Reg Date of Birth
Some libraries are getting dates of birth from the
self-registration form that make patrons impossible
ages, e.g. year of birth 1900.

To Test:
1) Navigate to the oPac
2) Ensure you are not logged in
3) Below the log in, see 'Create an Account'
4) Click the link and complete the relevant fields
5) Add an unrealistic d.o.b e.g 1900
6) Complete the verification and click 'Submit'
7) Your acount has been created
8) Apply the patch
9) Navigate to the staff site
10) Navigate to Administration > SystemPreferences
11) Navigate to OPAC preferences
12) Identify PatronSelfRegistrationAgeRestriction
13) Add a maximum age in numberals e.g. 100
14) Repeat steps 1 - 6
15) An error message that you have exceeded max age will appear.
16) Alter your date of birth to make your age below that of the max age you set
17) Complete the verification
18) Your account should be created as normal

Sponsored-by: Cheshire
Signed-off-by: Emmanuel Bétemps <e.betemps@gmail.com>
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-08 08:49:55 +02:00
David Cook ff403dcfb3
Bug 36586: Define self-checkin timer using Javascript class
This patch rewrites the self-checkin timer code to be defined in a
Javascript class which is then instantiated in once in sci-main.pl
depending on certain conditions (ie a barcode has been entered, or
an item has been checked in by barcode).

To test:
1 - Set SelfCheckinTimeout to a small value like 5
2 - Go to the self checkin:
    http://localhost:8080/cgi-bin/koha/sci/sci-main.pl
3 - Sign in as the SCI user
4 - Watch the page, it should refresh every 5 seconds
5 - Confirm that moving the mouse/typing prevents the reset
6 - Check in an item
7 - Wait and confirm reload of main page happens when idle
8 - Confirm mouse/typing prevents refresh
9 - Sign off!

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>

Bug 36586: Add sc-timer to sco

This patch implements the timer form the last patch on the sco

To test:
1 - Set SelfCheckTimout to 5 or something low for testing
2 - Go to the self checkout module
3 - Either sign in or confirm you have AutoSelfCheck user setup
4 - Observe the page reloads every 5 seocnds (or as you set above)
5 - Sign in as a patron
6 - Confirm on idle you are logged out to home page
7 - Sign off!

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>

Bug 36586: Fix tidy

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-08 07:59:09 +02:00
Fridolin Somers 0a32b7371f
Bug 39735: Fix typo in system preference call 'OPACFineNoRenewalsIncludeCredit'
Typo in system preference call 'OPACFineNoRenewalsIncludeCredit'
=> 'OPACFineNoRenewalsIncludeCredits'

Test plan :
Run : prove t/db_dependent/Circulation.t
Run test plan of Bug 23293

Signed-off-by: Roman Dolny <roman.dolny@jezuici.pl>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-07 14:29:53 +02:00
Fridolin Somers 49e852e0a8
Bug 39738: Obsolete call on system preference 'SelfCheckHelpMessage'
Bug 35065 moved to additional contents.
Remove call in opac/sco/help.pl.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-02 08:49:24 +02:00
Nick Clemens 3f649cfed7
Bug 36867: (follow-up) Don't check IP if ILS-DI disabled
When ILS-DI is disabled we still expect to return the correct service name/section in the
xml, but just indicate that it is disabled.

We should skip the check for authorized IPs in this case, as the IP only matters when service is enabled

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-05-02 08:49:17 +02:00
Pedro Amorim f9a97918bc
Bug 38441: ILLHistoryCheck: OPAC
Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-04-28 18:51:36 +02:00
Jonathan Druart 69b8341a8c
Bug 39325: Manual fixes
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-04-28 18:51:23 +02:00
Jonathan Druart 1d844a7d2f
Bug 39325: Automatic fix
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-04-28 18:51:22 +02:00
Nick Clemens b6763d622e
Bug 36867: Do not allow access to ILS-DI for IPs not explicitly listed in ILS-DI:AuthorizedIPs
This patch forces a check of authorized IPs against the Koha system preference, if nothing is present, no access is allowed

To test:
 1 - Enable ILS-DI, leave  ILS-DI:AuthorizedIPs blank
 2 - In another window:
    http://localhost:8080/cgi-bin/koha/ilsdi.pl?service=GetAvailability&id=1+2+99999&id_type=item
 3 - You get a response
 4 - Apply patch and restart all
 5 - Reload ilsdi page, 'Not authorized'
 6 - Copy the IP listed as refused and paste into ILS-DI:AuthorizedIPs
 7 - Reload the page, you get a response again
 8 - Change ILS-DI:AuthorizedIPs to:
    0:0:0:0/0
 9 - You still have access
10 - Paste your specific IP again, and add a second made up IP (comma separated)
11 - Reload and confirm you still have access

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-04-28 18:51:19 +02:00
Jonathan Druart 77a53e2c6f
Bug 38969: Prevent JS error when adding tags with quote at the OPAC
Uncaught SyntaxError: missing ) after argument list

There are way more to fix in this controller...

Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-04-28 18:51:17 +02:00
Tadeusz „tadzik” Sośnierz a715c695f7
Bug 39600: Cleanup the changes -- tidy, document, add a missing TT filter
Sponsored-by: Wiko <https://www.wiko-berlin.de/>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-04-25 19:23:40 +02:00
Tadeusz „tadzik” Sośnierz 44743bc3c7
Bug 39600: Switch OPAC ILL request listing to server-side rendering
This brings it technologically closer to intranet's ILL table and also enables pagination.

Test plan:

1. In KTD, go to http://localhost:8081/cgi-bin/koha/admin/preferences.pl?tab=&op=search&searchfield=master+switch and enable the ILL module
2. Run the following in koha-shell to populate the request list for user `koha`:

    perl -Mt::lib::TestBuilder -e '
      my $builder = t::lib::TestBuilder->new;

      do {
        $builder->build_sample_ill_request({borrowernumber => 51});
      } for (1..50);
    '
3. Navigate to http://localhost:8080/cgi-bin/koha/opac-illrequests.pl, log in as `koha` as needed
4. Observe the new request list being paginated and server-side-sortable

Sponsored-by: Wiko <https://www.wiko-berlin.de/>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-04-25 19:23:38 +02:00
Pedro Amorim 8c35c83272
Bug 36197: (QA follow-up): Adopt POST REDIRECT GET pattern
Upon submitting the unauthenticated request, the user is now redirected to a different page and the request details are passed through a session variable. This is to prevent the user from being able to resubmit the same unauthenticated request multiple times (see security bug 39611)

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-04-25 08:47:11 +02:00
Pedro Amorim e677ba112f
Bug 36197: (QA follow-up): Add public form captcha
Feedback provided by David Cook + Matthias Meusburger at KohaCon24

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-04-25 08:47:11 +02:00
Pedro Amorim ce3b8e0b0c
Bug 36197: (QA follow-up): Pass the filtered OPAC backends to OPAC template
The list of backends in the dropdown in this page:
http://localhost:8080/cgi-bin/koha/opac-illrequests.pl?op=create

If unauthenticated is enabled, this is listing all backends, instead of
making use of opac_available_backends.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-04-25 08:47:08 +02:00
Pedro Amorim d5198e5c49
Bug 36197: Only add cardnumber info to request is a user is logged in
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-04-25 08:47:05 +02:00
Pedro Amorim e55d647184
Bug 36197: Make authentication not required if conditions are met
/cgi-bin/koha/opac-illrequests.pl was an authrequired page
Now, its authnotrequired if creating or viewing an unauthenticated
request

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-04-25 08:47:04 +02:00
Pedro Amorim 0ee5fdd8af
Bug 36197: OPAC unauthenticated screen
unauth_view to show request details after its been submitted

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-04-25 08:47:03 +02:00
Pedro Amorim 2eff8bb298
Bug 36197: Refactor -> opac_available_backends method
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-04-25 08:47:01 +02:00
Pedro Amorim b3777fbbcb
Bug 36197: Consider unauthenticated_ill in 'Standard' create form
This also makes sure an empty left side bar exists for opac unauthenticated screens

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
2025-04-25 08:47:00 +02:00