fix double-click in Holdings Maintenance

so that it won't attempt to spawn the Item Editor for non-items

Signed-off-by: Jason Etheridge <jason@esilibrary.com>
Signed-off-by: Jason Stephenson <jstephenson@mvlc.org>
Signed-off-by: Lebbeous Fogle-Weekley <lebbeous@esilibrary.com>
Serial Note Sort Fix

Serial notes are currently sorting backwards from what is intended
(and what is expected based on other interfaces).  This was caused
by adding a sort to the middle-layer code which resulted in an
unwanted double reverse.

[whitespace adjustment by LFW per request of DBS]

Signed-off-by: Dan Wells <dbw2@calvin.edu>
Signed-off-by: Lebbeous Fogle-Weekley <lebbeous@esilibrary.com>
Remove unsafe thesaurus/control-set mapping

Evergreen 2.2 and beyond includes new Authority Control Set functionality
intended to allow the definition of locally defined authority control
headings.  The primary mechanism for determining which Control Set is used
by any given authority record is to look at the thesaurus fixed field
(mnemonic: Subj), which currently must be uniquely linked to a Control Set.
Failing that (in the case of no thesaurus code at all), there is a backup
mechanism: if the thesaurus value for the authority record is missing or not
used by any configured Control Set then Evergreen will look at the first Main
Entry (1xx) field in the record, and find a control set which uses this field.
This is, obviously, not perfect, but for non-overlapping authority field
schemes, it works very well.

However, the seed data for Evergreen currently includes the "no attempt to
code" value of "|" in the set of thesauri that point to the LoC Control Set.
This value ("|") is also the default value for the Subj fixed field.  This
means that the fallback mechanism is very likely never reached, and anything
short of fully specifying an appropriate thesaurus code for any non-LoC
authority record will run afoul of a similar outcome as the bib-data loss
situation described in bug #983487.

We can avoid this situation in most cases by /not/ tying the "|" thesaurus
value to the LoC control set.

This commit accomplishes this goal by allowing the Control Set for a thesaurus
to be NULL, removing the Control Set for "|" and removing the Control Set
recorded for records with "|" as the thesaurus value, thereby forcing Main
Entry inspection on any use of the authority record where Control Set is
required.

Signed-off-by: Mike Rylander <mrylander@gmail.com>
Signed-off-by: Lebbeous Fogle-Weekley <lebbeous@esilibrary.com>
Fix in-transit hold retarget

Tell the abort transit function to not commit our editor on us, basically.

Signed-off-by: Thomas Berezansky <tsbere@mvlc.org>
Signed-off-by: Lebbeous Fogle-Weekley <lebbeous@esilibrary.com>
Security fix for Launchpad Bug 1003052.

Bug reported by James Fournie:

Revoking the UPDATE_MARC permission doesn't actually seem to prevent a
user from editing a record. Our use case is that we would like a user
to create new records but not edit existing MARC records.

Changing CREATE_MARC to UPDATE_MARC in OpenILS::Application::Cat's
biblio_record_replace_marc() method seems to fix the problem.

Signed-off-by: Jason Stephenson <jstephenson@mvlc.org>
Signed-off-by: Lebbeous Fogle-Weekley <lebbeous@esilibrary.com>
Security fix: Prevent login by deleted and barred users

An existing comment in the code suggested that we thought we were already
keeping barred users out.  LP #1010671 brings up that deleted users were
not being kept out.

Signed-off-by: Lebbeous Fogle-Weekley <lebbeous@esilibrary.com>
Signed-off-by: Mike Rylander <mrylander@gmail.com>
Security fix: For auth, give same stacktrace for all cases of LOGIN_FAILED

Signed-off-by: Lebbeous Fogle-Weekley <lebbeous@esilibrary.com>
Signed-off-by: Bill Erickson <berick@esilibrary.com>
TPAC: Add record detail navigation to page bottom

A usability rule of thumb suggests that navigation on long pages should
not require you to scroll back up to the top of the page from the
bottom; that gets old fast. We already do this on search results pages;
bring the same good practice to record details.

Signed-off-by: Dan Scott <dan@coffeecode.net>
Signed-off-by: Dan Wells <dbw2@calvin.edu>
Fix version numbers in 2.1 -> 2.2 upgrade script

Justin Hopkins spotted the problem, and offered a fix in LP #1015807.
I'm just doing it slightly differently here.  Thanks Justin!

Signed-off-by: Lebbeous Fogle-Weekley <lebbeous@esilibrary.com>
lp#1014664: add new columns to CDBI table definitions

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Lebbeous Fogle-Weekley <lebbeous@esilibrary.com>
tpac: repair some straggling bookbag CGI param names

We missed some going from "id" to "bbid"

Signed-off-by: Bill Erickson <berick@esilibrary.com>
Signed-off-by: Jason Stephenson <jstephenson@mvlc.org>
Teach the autosuggest web service to cache suggestions where appropriate

Should spare some DB load on sites.

LFW: I'm not sure the update to the Apache config made any difference,
but it doesn't hurt.

Signed-off-by: Mike Rylander <mrylander@gmail.com>
Signed-off-by: Lebbeous Fogle-Weekley <lebbeous@esilibrary.com>
Signed-off-by: Bill Erickson <berick@esilibrary.com>
TPac: Add paging to My Lists

- Added paging to My Lists based on the code from the Checkout History tab.
- Fixed a bug where adding more than 10 items to the Temporary list failed
- After adding paging renaming a list on page 2+ would fail.  Fixed.
- Redirect after saving a list now leaves you on the same page
- Paging was bleeding between My Lists, Holds History and Circ History.
  Fixed.

List contents were also limited to the first 10.  I have upped the limit to
1000 rather than having nested paging.  This should be revisited.

CSV download of lists is still limited to the first 10.  Not sure where to
fix this.

Signed-off-by: Bob Wicksall <bwicksall@pls-net.org>
Signed-off-by: Ben Shum <bshum@biblio.org>
Signed-off-by: Jason Stephenson <jstephenson@mvlc.org>
Signed-off-by: Lebbeous Fogle-Weekley <lebbeous@esilibrary.com>
Avoid problem with 2.1 -> 2.2 upgrade script issuing error

The error is:
    > ERROR: cannot ALTER TABLE "thesaurus" because it has pending
    > trigger events.

Reported by Justin Hopkins, George Duimovich, and Bill Erickson.

Signed-off-by: Lebbeous Fogle-Weekley <lebbeous@esilibrary.com>
Signed-off-by: Justin Hopkins <hopkinsju@gmail.com>
TPAC: Handle multiple matches for an XPath expression

Per LP 1009980, "If a record has multiple subfield b's in the 260 field,
tpac will not display the publisher or publication date in the record
details page and will not display the publisher on the search results
page".

This is because we're calling textContent on a nodeset, rather than an
individual node, and therefore get null back rather than any content.

To avoid this, always expect a nodeset and iterate over it to populate a
list of the strings.  To maintain the same semantics of expecting a
single text string back for, say, args.pubdate, we define the list as
args.pubdates (plural name), and then grab the first item from the list
and populate that as args.pubdate (singular name).

Signed-off-by: Dan Scott <dan@coffeecode.net>
Signed-off-by: Ben Shum <bshum@biblio.org>
Repaired typo in example rsyslog config file

Signed-off-by: Bill Erickson <berick@esilibrary.com>
Signed-off-by: Dan Scott <dan@coffeecode.net>
Fix titles/tabs in Account Preferences subpages

Adjust the value of myopac_page in the Notification Preferences and
Search Preferences pages so that the page title and tab
color/hilight will be correct.

Signed-off-by: Jeff Godin <jgodin@tadl.org>
Signed-off-by: Jason Stephenson <jstephenson@mvlc.org>
Signed-off-by: Dan Scott <dan@coffeecode.net>
Silence undef string concatenation warning in AutoSuggest

Addressing LP #1023651 reported by Dan Scott.

When building a cache key, use processed input values that are
guaranteed to be defined rather than raw ones.

This will mean brief cache misses for AutoSuggest once applied, but
the default life of AutoSuggest cache entries is only 5 minutes anyway.

Signed-off-by: Lebbeous Fogle-Weekley <lebbeous@esilibrary.com>
Signed-off-by: Dan Scott <dscott@laurentian.ca>
TPac: Disable caching for auth-required pages

To make back buttons less likely to show sensitive info.

Signed-off-by: Thomas Berezansky <tsbere@mvlc.org>
Signed-off-by: Michael Peters <mrpeters@library.in.gov>
Signed-off-by: Dan Scott <dscott@laurentian.ca>
Merge remote-tracking branch 'upstream/rel_2_2' into rel_2_2