Bug 3652: close XSS vulnerabilities on biblionumber and authid

Previously we did not sanitize biblionumber and authids passed in by
the user.

To test:
1) Go to /cgi-bin/koha/opac-detail.pl?biblionumber=2hi (substituting a
   valid biblionumber for the 2).
2) Notice the presence of "2hi" on this page, and also on the ISBD and
   MARC views.
3) Go to /cgi-bin/koha/opac-authoritiesdetail.pl?authid=2bye
   (substituting a valid authid for the 2).
4) Notice the presence of "2bye" on this page.
3) Apply patch.
4) Notice that "2hi" and "2bye" strings are gone.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Bug 3652: close XSS vulnerabilities in opac-export

The opac-export.pl script had a number of XSS vulnerabilities relating
to its error handling.

To test:
1) Go to /cgi-bin/koha/opac-export.pl?op=export&bib=2&format=<h2>evil</h2>
   (substituting a valid biblionumber for the '2')
2) Notice that "evil" is rendered as an h2 heading.
3) Apply patch.
4) Notice that you now see the h2 tags, and they are not rendered by
   the browser.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
bug 3652 fixing XSS vulnerabilities in opac-search

Signed-off-by: Mason James <mtj@kohaaloha.com>
3.6.10 Translation Update
Add release notes for Koha 3.6.10
Merge remote-tracking branch 'tamil/3.6.10-translate' into 3.6.x
Bump version number for 3.6.10 release
Bug 8862 - merge.pl contains untranslatable strings

Signed-off-by: Frédéric Demians <f.demians@tamil.fr>

It works: (1) merging's still effective, and (2) two new error messages appear
in staff .po file after update it.

Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>

Conflicts:

	koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/merge.tt

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Liz Rea - Catalyst <liz@catalyst.net.nz>
Bug 8862 follow-up s/\t/4spaces/g

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Liz Rea - Catalyst <liz@catalyst.net.nz>
Bug 4177 opaccloud missing from the system preferences interface

There is no option to toggle the (existing) syspref OpacCloud. This patch adds one.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Inserted tags manually, enabled system preference, tag subject cloud displays nicely.

Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Liz Rea - Catalyst <liz@catalyst.net.nz>
Bug 8792 : Babeltheque: Remove the unused tab on the opac detail page

Signed-off-by: Marc Veron <veron@veron.ch>
Babeltheque tab is removed as expected

Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>

Conflicts:

	koha-tmpl/opac-tmpl/prog/en/modules/opac-detail.tt

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Liz Rea - Catalyst <liz@catalyst.net.nz>
Bug 8953 - opac-userupdate encoding issues

This script has various encoding problems:

1. parametars from CGI are not encoded in utf-8, so when they are
   compared with utf-8 strings from database every field with
   utf-8 characters will be reported in e-mail as changed
2. when sending e-mail, wide characters are passed to Mail::Sendmail
   which results in software error if edited field has utf-8 characters
   (because of first point, this happend if ANY fields has utf-8 chars)
3. when declaring encoding for outgoing e-mail utf-8 is more correct
   than just utf8

Test scenario:

1. open opac-userupdate and edit user which has utf-8 characters in
   at least one field (firstname and surname are common examples)
2. edit one of other fields and add utf-8 character to it
3. verify that e-mail with changes arrived with just edited field

Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Liz Rea - Catalyst <liz@catalyst.net.nz>
But 8787: don't load the page if OpacMaintenance is ON

If the syspref OpacMaintenance is ON, it is useless to loaded the
requested page.

To test:
- switch on the syspref OpacMaintenace
- check in your apache access log, zebra log, etc. the requested page is
  not loaded (i.e. on the opac-search.pl page)

Signed-off-by: Marc Veron <veron@veron.ch>
Checked by watching  other_vhosts_access.log
Works as expected

Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Liz Rea - Catalyst <liz@catalyst.net.nz>
Bug 8910 - silent warnings triggered in about.pl

In order to detect the apache version, there are multiple
commands used. These may not all exist, which triggers error log
entries. By simply adding " 2> /dev/null", the errors are no
longer generated.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Liz Rea - Catalyst <liz@catalyst.net.nz>