Bug 10590 - in opac-topissues limit param is not protected

In opac-topissues page, the limit URL argument is directly added to SQL query.

This patch adds protections : limit must only contain digits and must be lower than 100.

Test plan :
- Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=10&branch=&itemtype=&timeLimit=999&do_it=1
=> You get the results of 10 most cheched-out of all time
- Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=&branch=&itemtype=&timeLimit=999&do_it=1
=> You get the results of 10 most cheched-out of all time
- Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=9999&branch=&itemtype=&timeLimit=999&do_it=1
=> You get the results of 100 most cheched-out of all time
- Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=WHERE&branch=&itemtype=&timeLimit=999&do_it=1
=> You get the results of 10 most cheched-out of all time

Signed-off-by: Robin Sheat <robin@catalyst.net.nz>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 57866d6b67c3f8b29290150f21c71395315a73fe)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 10590 - parameterise the limit option

The limit option was previously substituted directly into the query. The
previous patch on bug 10590 filters it on input, but there's no reason
not to have it made to work properly in the query for added safety.

To test:

[1] Go to the top checkouts report (http://OPAC/cgi-bin/koha/opac-topissues.pl)
[2] Run the report several times, varying the filters on
    number of results and item type.
[3] Verify the the list of top checkouts appears to be correct.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 89cf013a6fadcb1347151798f3fdab0d8c75cd15)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 7110: Renewal messages no longer displays in OPAC if OpacRenewalAllowed is disabled

Prior to this patch, if a patron has fines which exceed the limit set by
OPACFineNoRenewals but OPAC renewals are disallowed by OpacRenewalAllowed,
a message was displayed in their OPAC summary like this:

"Please note: You currently owe XXX in fines. Please pay your fines if you wish
to renew your books."

Information about outstanding fines in this case has no bearing on
how the user sees his summary of checkouts; since the user cannot
renew the loans from the OPAC regardless of their fine balance if
OpacRenewalAllowed is not enabled, this patch removes the message.

To test, try various combinations of OpacRenewalAllowed and
OPACFineNoRenewals with a patron who has outstanding fines:

- OpacRenewalAllowed ON and OPACFineNoRenewals ON (set to be triggered
  by the test patron's fines): Logging in to the OPAC the patron should
  see a warning on opac-user.pl about not being able to renew items
  because of fines.

- OpacRenewalAllowed ON and OPACFineNoRenewals OFF (threshold high
  enough not to trigger a block): No warning appears.

- OpacRenewalAllowed OFF and OPACFineNoRenewals ON: No warning appears.

- OpacRenewalAllowed OFF and OPACFineNoRenewals OFF: No warning appears.

If OpacRenewalAllowed is diabled and a patron's fines exceed the limit
set by OPACFineNoRenewals they should see no message.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Passes koha-ql.pl and perlcritic

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 29edd3797a7c950664ebc3be272ad4dca2575a80)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
bug 10495: set precondition for HoldsQueue test

t/db_dependent/HoldsQueue.t assumed, but did not check,
that the AutomaticItemReturns system preference was off
at the beginning of the test un.  This patch makes sure
that that assumption is met.

To test:

[1] Make sure that at least one item is on loan (this is
    another assumption that the test case makes, one
    that should be corrected with the work proposed
    for bug 10336.
[2] Turn the AutomaticItemReturn system preference on.
[3] Run the test:

prove -v t/db_dependent/HoldsQueue.t

[4] Tests 4 and 6 should fail.
[5] Apply the patch.
[6] Run the test case again; this time, all tests should pass.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 4e51ec5aae50c878bbdca6994361b12d7ba20d0a)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 10336: HoldsQueue.t needs to create its own data

After applying this patch and the patch submitted in bug 10495, you can
run prove t/db_dependent/HoldsQueue.t and admire that all tests pass.

This patch creates a borrower and uses Koha routines instead of directly
updating the database.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit bfbc646fdd9ca4b90a0bc2751d0faa95d9e93ba1)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 10386: improvements to VirtualShelves.t

Most important: Does no longer delete all shelves!
Checks if there are ten borrowers for testing. But even works without them :)
When creating or modifying lists, takes name clashes into consideration.

Small change to _CheckShelfName in VirtualShelves module. Making it possible to
check a name for a list whose owner has been set to NULL. Note that a test
like field=? with undef for placeholder will not work in MySql.

Test plan:
How do you test a test? Well, you could run it on various databases..
But for real hacking, you could also add some debug lines.
I tested this by forcing 10 undefs in @borrowernumbers.
And by overwriting the return value of randomname with an existing name.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 93e87ca0b61611fc35238bf13eb226f477cf9c4e)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 8884: opacheader is not in the header on CCSR

In CCSR the opacheader preference isn't really in the header it's to the
right of the search box (see attached). I'm okay with a customizable
region over there, but we should have a new preference for that and
header should be above the search box as it implies.

To test:
1) Put something in the OpacHeader syspref. Preferably something large
   and header-like for maximum effect.
2) Select CCSR theme.
3) View OPAC. Notice placement of "header" content.
4) Apply patch.
5) View OPAC. Notice placement of "header" content.
6) Sign off.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Passes koha-qa.pl, works as advertised with one caveat; the content of
opacheader is by default underneath the div "top-bar". A couple breaks
in my OpacHeader test made it visible, so I'm going to assume this is a
styling issue and not a bug as such.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 905292b6328bbc847b1b932fc15dfef9e9845295)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 8884: (follow-up) rearrange placement of the top-bar div in CCSR

This patch makes it easier to avoid having the top bar
overlap other OPAC page content (particularly custom
header content set via the opacheader system preference).

This is done by moving the top-nav div outside of the
main doc3 div and adjusting the CSS accordingly.  Yes,
this does end up having top-nav.inc be included from
opac-bottom.inc, but it would require touching rather
more templates to have it be included immediately after
the <body> tag.

This patch also removes a duplicate instance of the
cmspan span.

To test:

[1] Change to the CCSR OPAC theme.
[2] Before applying the patch, open a set of OPAC
    pages (e.g., main page, user page, search results, bib
    details) in your web browser.
[3] Apply the patch, and open the same OPAC pages in separate
    tabs.  Comparing the pre- and post- version of each page
    to verify that the placement
[4] Add an OpAC header using the opacheader system preference.
[5] Verify that the header is displayed without overlapping
    the top bar.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 33c12cf39588aa022eacaa0bca403c373a6bf8d5)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 10494: test cases for the KohaBranchName plugin

To test, in a test database that has the sample branches
loaded, run

prove -v t/db_dependent/Koha_template_plugin_KohaBranchName.t

Note that this includes regression tests for the issues
reported in bug 10494; these won't pass without applying
the patch that fixes them.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 96320a786bac92418b08b5af4d2b68746627482b)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 10494: remove spurious warnings from the KohaBranchName plugin

The KohaBranchName plugin now returns an empty string if
given a NULL (undefined) library code or a library code that
is not present in the database (e.g., the '__ANY__' placeholder
that purchase suggestions can use).

To test:

[1] Create a purchase suggestion, setting the library
    to 'Any'.  Create a second one setting the library to
    a specific one.
[2] Go to the suggestions overview page in the staff interface.
    When you do so, the Apache logs should contain a warning
    that looks like this:

[Wed Jun 19 07:13:06 2013] [error] [client 192.168.1.10] [Wed Jun 19 07:13:06 2013] suggestion.pl: Use of uninitialized value in concatenation (.) or string at /home/koha/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt line 487., referer: http://koha-staff.metaquarry/cgi-bin/koha/acqui/acqui-home.pl

[3] Apply the patch.
[4] Refresh the suggestions overview page.  This time, there should be
    no new warning logged.
[5] Verify that the library names for the two pending suggestions
    created in step 1 are displayed correctly.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Passes all tests and QA script. Also adds new tests!

Note: For the test plan to work you have to add the suggestion
from the intranet, as Any is not an available option in OPAC.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit ad2c1b3b8f20b3060c9a3a35c21a0757c685cbec)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 10484: serials-edit.pl not checking for barcode field before checking for barcode subfield

The script serials-edit.pl is not checking for the existence of the
barcode field before checking for barcode subfield for autoBarcode =
incremental. If the barcode field doesn't exist, the script dies with
errors.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Passes tests and QA script.
Checked that adding items on serial receive still works.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 9af08e4e2d2091de489633b3f1c4fb03fcf323cd)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 6553 - Parentheses in Corporate author break tracings

To test:

If an author's name includes parentheses or other escape-characters, the tracing links
produced in the OPAC fail in XSLT mode.  This patch wraps the author names
in double-quotes, providing the necessary escapement.

Test plan:
- Create a new framework, delete Thesaurus from 100 and other fields
- Create a new record in this framework (or change an existing record to this framework)
- Add 100$a - use parentheses
- Check the search links in OPAC detail pages

Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
XSLT change adding quotes. Search now matches search in the intranet.
Passes all tests.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 41409f500edf495db114b2277f4916e5a737a0aa)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 10497 - star ratings not showing right in ccsr detail

Star ratings do not appear correctly in the CCSR theme because it lacks
the image sprite used to display them. This patch adds the required
file.

To test, apply the patch and view a search results set which includes
titles which have an existing rating. Ratings should appear correctly.

View a detail page for an title which has a rating, and add a rating to
a title which has no rating. Ratings should look correct and work
correctly.

Signed-off-by: Nicole C. Engard <nengard@bywatersolutions.com>
All tests pass - including leaving a rating on the newly visible stars

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
In order to test this, make sure you have set OpacStarRatings set
to 'results and details'.

The star images show up in OPAC results with the correct amount
of stars after applying the patch.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 2fccb14a806e9aad18cc9f75df39e09bd64830dd)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 10510 - OPAC's renew selected link has glitchy icon

The "renew selected" link on the list of a user's checkouts looks bad
because the next icon in the sprite shows through. This patch modifies
the sprite to give it proper spacing and corrects the CSS to accommodate
the change.

To test, apply the patch, clear your browser cache, and view the
following pages to confirm that the change works:

- With TagsEnabled and TagsInputOnList enabled, view a search results
  page when logged in and when not logged in. Tag links should be
  styled correctly.

- With OpacBrowseResults enabled, open the detail page for any record
  and click the "browse shelf" link. The "forward" and "back" arrows
  should be styled correctly.

- With OpacRenewalAllowed enabled, log in to the OPAC and view your
  checked out items. The "renew selected" and "renew all" links should
  look correct.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Note: this will fix only the prog theme, but not the ccsr theme.
And it works perfectly.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 1a1658f020e482abdd35fc8afc04cfcbce91e046)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 10029 - CAS authentication fails in OPAC reserve

If OPAC reserve page is accessed without being logged-in, login form is displayed as well as a CAS authentication link (if enabled). A click on this link will lead to CAS server but one comming back to Koha, page shows an error : "ERROR: No biblionumber received".
This is because CAS link only contains the query path "/cgi-bin/koha/opac-reserve.pl", not the query parameters.

This patch adds query parameters to URI sent to CAS.

Test plan :
- Enable CAS
- Go to opac without been logged-in
- Try to place hold on a record
=> You get to /cgi-bin/koha/opac-reserve.pl?biblionumber=XXX showing authentication page
=> Check that CAS link contains query param "biblionumber"
- Click on CAS link and log in
=> Check you return well logged-in to reserve page with biblionumber param

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
I have followed the test plan as far as I could and the links
contain the biblionumber now, which they didn't before.
I couldn't check the CAS login, but my normal login worked
as expected.
All tests and the QA script pass.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 974ab561ef00e76e7329f61b016b5d6b3103dde7)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 10428: undefined check in add additem.pl

In additem.pl, in the code that generates item form you find:

@values = $itemrecord->field($tag)->subfield($subtag) if ($itemrecord && defined($itemrecord->field($tag)->subfield($subtag)));

This patch adds the check of $itemrecord->field($tag) undef.
I did not found a way to test it because item tag is always defined
when editing an item, but it would be safer/prettier to add this check.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Passed-QA-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit e31b158245f4eff36decebf30c8a87c8cfebe472)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 10346 - "Add multiple copies" should be labelled "Add multiple items"

The Koha interface standardizes on the term "item" instead of "copy," so
the "Add multiple copies" button would be more correctly labeled "Add
multiple items."

To test, view the add item screen for an existing or new record. You
should see a button labeled "Add multiple items."

Signed-off-by: Cedric Vita <cedric.vita@dracenie.com>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 79df5211d6faff8ab31b46c815ed50c70093a057)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 5894: Display all titles when confirming copy of items from cart to list

Adds missing code that splits biblios before calling template.

To test:
- Add some items to cart
- Open cart, select some or all items
- Add to list; with patch, following window shold show something
  like "Add 3 items to a list:", followed by list of items

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Passes koha-qa.pl, works as advertised.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit bed99a851646fd0c7a4c906dd9dfe60c485b40c6)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 9113: fix handling of certain characters by item batch modification tool

If you're using the batch modification tool and entering a call number
like "E+ 123 ABC", the tool removes the + and puts a space in its place,
e.g., "E  123 ABC"

This is because the form is posted via Ajax by background-job-progressbar.js.
Values are URI-encoded using escape(), but this method does not escape some
characters: * @ - _ + . /

Also, "+" is considered as a space in a URI.

This patch replaces escape() by encodeURIComponent() which encodes every character.

Test plan :
Perform an items batch modification by setting '* @ - _ + . /' in a field
(notes for example) and see that all characters are saved correctly.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 0397e7ea64c208c140d7178ed34c3bd4b266fcfb)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 9533: batch item modification form now shows default field values only by request

This patch makes the pre-population of the fields for the batch
item editor with the default values from the default framework
optional and off by default.

Test Plan:
1) Apply patch
2) Add default values for cost and replacement cost to the
   default framework.
3) Browse to Tools / Batch item modification
4) Choose a file, or entire some barcodes in the text area
5) Ensure that the 'Populate fields with default values from default
   framework' is *not* checked
6) Click 'Continue'
7) Observe that the fields for cost and replacement cost are blank
8) Click the 'back' button on your browser
9) Check the checkbox to enable the default value
10) Click 'Continue'
11) Observe that the fields for cost and replacement cost now contain
    the default values you assigned them in the default MARC framework

Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Switch works correctly, all tests and QA script pass.

Note: there is a bug with default values for all non text input
fields. Default values won't be applied for those fields as the
pull downs are not preselected correctly with the default values
defined in the framework.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 2d32ab38148f7d75412a36e928dea799717bc5fb)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>