Bug 11059: fix date sorting of import batches in basket add form

This patch improves the sorting of staged import batches by date,
particularly when the dateformat system preference is set to anything
other than YYYY-MM-DD.

Adds title-string sorting type to enable this.

To test:

[1] Ensure that there are at least three staged
    bib import batches, with upload timestamps such that
    date sorting errors would be apparent.
[2] Set the dateformat system preference to either DD/MM/YYYY
    or MM/DD/YYYY.
[3] Create a new basket in acquisitions, then chose to add
    a new order line from a staged record batch.
[4] In the list of batches, click on the 'staged' column
    heading to sort by date.
[5] Observe that dates are sorted in alphanumeric order, not date
    order.
[6] Apply the patch and refresh.  This time, dates should sort
    correctly.

Signed-off-by: Fridolyn SOMERS <fridolyn.somers@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 11059: (follow-up) restore time in staged dates in addorderiso2709.tt

Follow-up patch to restore the display of time in
acqui/addorderiso2709.tt in staged date.
Simply uses an option of KohaDates TT plugin.
This time may be useful if there where several imports in the same day.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 2693: add ability to filter by reviewer name on tag review page

If you want to filter results on the tags management page by the
reviewer you have to know their borrowernumber. It would be better to be
able to search by name, but in the meantime this patch adds an
autocomplete widget to the form field so that you can do a name search
and populate the field with the borrowernumber.

To test you must have approved or rejected tags. From the tags review
page (tags/review.pl), view all, approved, or rejected tags. Type a name
in the "reviewer" form field in the left sidebar filter. You should get
an autocomplete dropdown with names matching your search. When you
select one the form field should be populated by the borrowernumber.

Signed-off-by: David Cook <dcook@prosentient.com.au>

Patch works as described. I'm not sure whether or not it would be better
to be able to search by name, as that would involve either choosing
between names after applying the filter or showing any possible matches,
so this seems fine.

--

Owen and I did observe that we were able to cause AJAX errors while
using this autocomplete, but we are not 100% sure how we caused the error.
In my case, I was able to occasionally cause it by typing in a name
then backspacing rapidly. The ajaxError method is attached to every
element in the DOM (yikes) so it's tough to say what exactly is the
source of the error (which is signalled by a pop-up window that can be
cancelled).

The error is quite rare so I don't think it's necessarily a problem
for us.

One idea that Owen had was to remove the current error message, which
is very unhelpful and replace it with an error like "Something went
wrong. Try again."

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 7791: add ability to delete records when deleting a basket

Currently, when a basket is deleted, all the orders are deleted (there
is a foreign key in aqorders table on basketno).

This could be dangerous, and there is no warning.
After the deletion, unused biblios are left in the catalogue.

This patch
- adds a more detailed message describing the consequences of deletion
- give the choice of also deleting biblio records if possible

To test :
Test A :
1. create a basket with 4 orders:
- an order from a new record A
- an order from a record B which has already an item
- an order from a record C used in a subscription
- an order from a record D used in an other order
2. note the biblionumbers of the records used (or open them in other
   tabs in your browser)
3. click on "Delete basket"
4. choose button "Delete basket and orders"
5. check the catalogue : records A,B,C,D should still be there
Test B:
1. create a basket with 4 orders:
- an order from a new record A
- an order from a record B which has already an item
- an order from a record C used in a subscription
- an order from a record D used in an other order
2. note the biblionumbers of the records used (or open them in other
   tabs in your browser)
3. click on "Delete basket"
4. choose button "Delete basket, orders and records"
5. check the catalogue : records B,C,D should still be there. Record A
   should be deleted

Signed-off-by: Cedric Vita <cedric.vita@dracenie.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 7791: (follow-up) tidy up some cruft in the main patch

This patch
- delete warns
- add a missing }
- add a condition in template of avoiding asking to delete orders or
  records if the basket is empty

To test :
1. Make the same tests as defined in test plan of main patch. It should
   behave the same way
2. Try to delete a basket with no records inside. You will only have a
   "Delete basket" button, with fewer warnings

Signed-off-by: Cedric Vita <cedric.vita@dracenie.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 7791: (follow-up) add warning after deletion if some records were not deleted

This followup add some warnings after deletion if some items were not
deleted.

4 types of messages are possible :
- x item(s) attached.
- x subscription(s) attached.
- x order(s) attached.
- Unknown error.

To test :
test a
1. create a basket with
- an order using a record A which has already an item, which is used in
   a subscription, and in other order (in an other basket)
- an order using a record B used nowhere elese
2. click on "Delete basket"
3. choose button "Delete basket, orders and records"
4. you should see a page anouncing basket deletion, and that record A was
   not deleted because of its item, subscription and order.
5. check the link around the title of record B takes you to the record
6. check the link under the warning box ("Click here to go back to
   booksellers page") takes you to booksellers page
5. check record B is deleted

test b
1. suppress the subscription linked with record A
2. create an other basket using record A
3. delete the basket on the same way as for test a
4. you should see a page anouncing basket deletion, and that record A was
   not deleted because of its item and order

test c
1. suppress the item attached under record A
2. create an other basket using record A
3. delete the basket on the same way as for test a
4. you should see a page anouncing basket deletion, and that record A
   was not deleted because of its orderBug 7791 Followup: add warning
    after deletion if some records were not deleted

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 7791: (follow-up) adjust wording of basket deletion confirmation dialog

This patch uses "bib" and "bibliographic record" rather than just
"record"; "record" is not quite specific enough in this context.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 11322: fix XSS bug in purchase suggestions pages

To test
1/ Switch on purchase suggestions
2/ On the public interface (OPAC) add a suggestion, put html in every
field
3/ In the staff interface go to the suggestions page
/cgi-bin/koha/suggestion/suggestion.pl
4/ Notice the html is rendered
5/ Click on a suggestion, notice the html is rendered on the show page
also
6/ Apply the patch, check these two pages again, html should now be
escaped

Signed-off-by: David Cook <dcook@prosentient.com.au>

Works as described.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Passes all tests, thx Chris!

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 11322: fix XSS bug in purchase suggestions - OPAC

1/ Add a suggestion in the opac, with lots of html
2/ View that suggestion in the OPAC, note the html is rendering
3/ Apply the patch
4/ Test again, in prog and bootstrap, no more rendered html

Signed-off-by: David Cook <dcook@prosentient.com.au>

Works as described.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 11322: rscrub bad data before storing suggestions in the DB

1/ In the public interface, add a suggestion containing html
2/ Save, notice the html is rendered (or if you have the other patches
is displayed)
3/ Apply this paget
4/ Add another suggestion
5/ Notice the html is stripped

Signed-off-by: David Cook <dcook@prosentient.com.au>

Works as described.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>