Bug 11183: get rid of some log noise from the OPAC

To test in OPAC:
* With the OPAC System Preference EnableOpacSearchHistory set
  to Keep, a simple search triggers the warning patched on
  line 626 of opac-search.pl
* Selecting a search result item with no Collection Code
  set triggers the warning patched on line 576 of opac-detail.pl
* Have an item with Collection Code. Check that the Collection
  Code shows.
* Collection Code is set by editing an item in the staff client
  (952$8)

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 11242: fix opac-MARCdetail.pl display and warnings

This patch improves the public catalog MARC view display
of records that contain subfields that are not defined in
the framework used by the bib record.

To test:

(RM note: it may be easier to find or create a MARC record that
 contains a subfield not present in the default framework, then
 load it, rather than fiddle with the MARC frameworks in your
 test database.)

BACK UP YOUR DATABASE!
 1) Search for an item in OPAC
 2) Open OPAC detail
 3) Click 'MARC View' link
 4) Look for something with multiple lines (e.g. 260 or 942)
 5) In another tab, Go to staff client and log in
 6) Go to the staff client URL similar to:
     /cgi-bin/koha/catalogue/detail.pl?biblionumber=##### page
    where ##### is the biblionumber.
 7) Edit -> record
 8) Note the framework used.
 9) More -> Administration
10) MARC bibliographic frameworks
11) Click 'MARC structure' for the framework used by the item
     shown in OPAC.
12) Find the tag (e.g. 260 or 942) and click 'Subfields'
13) Delete of the matching subfields (e.g. 260$b) shown in the
     OPAC tab
14) Clear your opac error log.
15) Refresh OPAC tab. The tag subfields are split.
16) There are opac-MARCdetail.pl warnings.
17) Apply patch
18) Clear your opac error log.
19) Refresh OPAC tab. The tag subfields are no longer split strangely.
20) There are no opac-MARCdetail.pl warnings.
RESTORE YOUR DATABASE.

This also silences a series of warnings triggered by catching
undef hash references.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 11059: fix date sorting of import batches in basket add form

This patch improves the sorting of staged import batches by date,
particularly when the dateformat system preference is set to anything
other than YYYY-MM-DD.

Adds title-string sorting type to enable this.

To test:

[1] Ensure that there are at least three staged
    bib import batches, with upload timestamps such that
    date sorting errors would be apparent.
[2] Set the dateformat system preference to either DD/MM/YYYY
    or MM/DD/YYYY.
[3] Create a new basket in acquisitions, then chose to add
    a new order line from a staged record batch.
[4] In the list of batches, click on the 'staged' column
    heading to sort by date.
[5] Observe that dates are sorted in alphanumeric order, not date
    order.
[6] Apply the patch and refresh.  This time, dates should sort
    correctly.

Signed-off-by: Fridolyn SOMERS <fridolyn.somers@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 11059: (follow-up) restore time in staged dates in addorderiso2709.tt

Follow-up patch to restore the display of time in
acqui/addorderiso2709.tt in staged date.
Simply uses an option of KohaDates TT plugin.
This time may be useful if there where several imports in the same day.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 2693: add ability to filter by reviewer name on tag review page

If you want to filter results on the tags management page by the
reviewer you have to know their borrowernumber. It would be better to be
able to search by name, but in the meantime this patch adds an
autocomplete widget to the form field so that you can do a name search
and populate the field with the borrowernumber.

To test you must have approved or rejected tags. From the tags review
page (tags/review.pl), view all, approved, or rejected tags. Type a name
in the "reviewer" form field in the left sidebar filter. You should get
an autocomplete dropdown with names matching your search. When you
select one the form field should be populated by the borrowernumber.

Signed-off-by: David Cook <dcook@prosentient.com.au>

Patch works as described. I'm not sure whether or not it would be better
to be able to search by name, as that would involve either choosing
between names after applying the filter or showing any possible matches,
so this seems fine.

--

Owen and I did observe that we were able to cause AJAX errors while
using this autocomplete, but we are not 100% sure how we caused the error.
In my case, I was able to occasionally cause it by typing in a name
then backspacing rapidly. The ajaxError method is attached to every
element in the DOM (yikes) so it's tough to say what exactly is the
source of the error (which is signalled by a pop-up window that can be
cancelled).

The error is quite rare so I don't think it's necessarily a problem
for us.

One idea that Owen had was to remove the current error message, which
is very unhelpful and replace it with an error like "Something went
wrong. Try again."

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 7791: add ability to delete records when deleting a basket

Currently, when a basket is deleted, all the orders are deleted (there
is a foreign key in aqorders table on basketno).

This could be dangerous, and there is no warning.
After the deletion, unused biblios are left in the catalogue.

This patch
- adds a more detailed message describing the consequences of deletion
- give the choice of also deleting biblio records if possible

To test :
Test A :
1. create a basket with 4 orders:
- an order from a new record A
- an order from a record B which has already an item
- an order from a record C used in a subscription
- an order from a record D used in an other order
2. note the biblionumbers of the records used (or open them in other
   tabs in your browser)
3. click on "Delete basket"
4. choose button "Delete basket and orders"
5. check the catalogue : records A,B,C,D should still be there
Test B:
1. create a basket with 4 orders:
- an order from a new record A
- an order from a record B which has already an item
- an order from a record C used in a subscription
- an order from a record D used in an other order
2. note the biblionumbers of the records used (or open them in other
   tabs in your browser)
3. click on "Delete basket"
4. choose button "Delete basket, orders and records"
5. check the catalogue : records B,C,D should still be there. Record A
   should be deleted

Signed-off-by: Cedric Vita <cedric.vita@dracenie.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 7791: (follow-up) tidy up some cruft in the main patch

This patch
- delete warns
- add a missing }
- add a condition in template of avoiding asking to delete orders or
  records if the basket is empty

To test :
1. Make the same tests as defined in test plan of main patch. It should
   behave the same way
2. Try to delete a basket with no records inside. You will only have a
   "Delete basket" button, with fewer warnings

Signed-off-by: Cedric Vita <cedric.vita@dracenie.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 7791: (follow-up) add warning after deletion if some records were not deleted

This followup add some warnings after deletion if some items were not
deleted.

4 types of messages are possible :
- x item(s) attached.
- x subscription(s) attached.
- x order(s) attached.
- Unknown error.

To test :
test a
1. create a basket with
- an order using a record A which has already an item, which is used in
   a subscription, and in other order (in an other basket)
- an order using a record B used nowhere elese
2. click on "Delete basket"
3. choose button "Delete basket, orders and records"
4. you should see a page anouncing basket deletion, and that record A was
   not deleted because of its item, subscription and order.
5. check the link around the title of record B takes you to the record
6. check the link under the warning box ("Click here to go back to
   booksellers page") takes you to booksellers page
5. check record B is deleted

test b
1. suppress the subscription linked with record A
2. create an other basket using record A
3. delete the basket on the same way as for test a
4. you should see a page anouncing basket deletion, and that record A was
   not deleted because of its item and order

test c
1. suppress the item attached under record A
2. create an other basket using record A
3. delete the basket on the same way as for test a
4. you should see a page anouncing basket deletion, and that record A
   was not deleted because of its orderBug 7791 Followup: add warning
    after deletion if some records were not deleted

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 7791: (follow-up) adjust wording of basket deletion confirmation dialog

This patch uses "bib" and "bibliographic record" rather than just
"record"; "record" is not quite specific enough in this context.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 11322: fix XSS bug in purchase suggestions pages

To test
1/ Switch on purchase suggestions
2/ On the public interface (OPAC) add a suggestion, put html in every
field
3/ In the staff interface go to the suggestions page
/cgi-bin/koha/suggestion/suggestion.pl
4/ Notice the html is rendered
5/ Click on a suggestion, notice the html is rendered on the show page
also
6/ Apply the patch, check these two pages again, html should now be
escaped

Signed-off-by: David Cook <dcook@prosentient.com.au>

Works as described.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Passes all tests, thx Chris!

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 11322: fix XSS bug in purchase suggestions - OPAC

1/ Add a suggestion in the opac, with lots of html
2/ View that suggestion in the OPAC, note the html is rendering
3/ Apply the patch
4/ Test again, in prog and bootstrap, no more rendered html

Signed-off-by: David Cook <dcook@prosentient.com.au>

Works as described.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 11322: rscrub bad data before storing suggestions in the DB

1/ In the public interface, add a suggestion containing html
2/ Save, notice the html is rendered (or if you have the other patches
is displayed)
3/ Apply this paget
4/ Add another suggestion
5/ Notice the html is stripped

Signed-off-by: David Cook <dcook@prosentient.com.au>

Works as described.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 11035: Replace shortcut plugin jquery.hotkeys.min.js

To old plugin prevents the upgrade to the latest jquery. By replacing
with openjs' shortcut.js, we have now one less hurdle in upgrading
Koha to latest.

Changes:
- removed jquery.hotkeys.min.js
- added shortcut.js
- modified the related includes (doc-head-close.inc and help-top.inc)
- modified the calls in staff-global.js

Regression test:
1) apply the patch
2) in the intranet, test the shortcuts alt-q, alt-r, alt-u.

These are the only affected functionalities.  There is no new functionality.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Passes all tests and QA script. Tested existing
shortcuts for the search bar tabs on various circulation
related pages.

This uses a Javascript under BSD license, I wonder if it
should be listed in the About>licenses section that we
are using it. As Yui is also BSD I assume the license is
compatible.

+/**
+ * http://www.openjs.com/scripts/events/keyboard_shortcuts/
+ * Version : 2.01.B
+ * By Binny V A
+ * License : BSD
+ */

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 11035: (follow-up) update offline circ manifest

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 11035: (follow-up) move shortcut.js

shortcut.js is not a jQuery plugin, so this patch
moves it out of the jquery plugin directory.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 11035: (follow-up) update licenses section

The OpenJS keyboard shortcuts library by Binny V A is licensed under
the BSD license.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 5031: CSV profiles: validate required content fields

Some fields are required on editing/adding CSV profiles.  This
patch adds HTML5 validation so that required fields must be
filled in before the form is submitted.

Test plan:
- add a new CSV profile (tools/csv-profiles.pl) without any value.
- save => error on empty fields.
- fill the "marc" content, select type="sql", fill the CSV name input.
- save => error on sql content field.
- fill the sql content
- save => the CSV profile is saved.
- retry for the edit form.

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>

Comment: On top of both patches for Bug 10853

Works very well, now we get an alert with empty field
Saves correctly MARC and SQL profiles

Solved minor conflict introduced by tab followup on Bug 10853
Again small tab errors corrected in followup

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Works as described, looks a bit 'non standard' for Koha,
but improves usability of the form.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 5031: (follow-up) correct tabs

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Tiny QA follow-up corrcting whitespace to match coding
guidelines.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 11341: fix XSS bug in opac-search.pl (facets)

This patch fixes the prog theme; the bootstrap theme already
does the necessary filtering.

To test
1/ Craft a url like
 cgi-bin/koha/opac-search.pl?idx=kw&q=fish&offset=20" onmouseover%3dprompt(994000) bad%3d"
 (the search must return enough results to have a show more link in the facets)

2/ Check the source, or mouseover the Show more links in the facets
   Notice the code is executable

3/ Apply patch - notice it is no longer executable

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 11077: remove uninitialized value $pki_field warning

During login at the Staff interface you get warnings in the logs
regarding an uninitialized value for the $pki_field variable.

To test:
- tail -f /path/to/your-intranet-logs
- Point your browser to your staff login page
- Login
- Three warnings are showed
- Apply the patch
- Log out
- Log in
- No new warnings, and you can still log in.

Sponsored-by: Universidad Nacional de Cordoba
Signed-off-by: Petter Goksoyr Asen <boutrosboutrosboutros@gmail.com>

Followed test plan; it works as advertised.
Also works when I deleted AllowPKIAuth system pref.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>