Update history.txt for Koha 3.14.0 release

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 3fe0e784516309050fc5b6eda1ab7fdaf7643048)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 11307: Fix potential XSS attack in public catalog RSS feed

To test:
1/ Craft a url like
/cgi-bin/koha/opac-search.pl?q=a&count=50"'<h1>test</h1>&sort_by=acqdate_dsc&format=rss2
2/ look at the source, notice
<opensearch:itemsPerPage>50"'<h1>test</h1></opensearch:itemsPerPage>
3/ apply the patch, and reload url
4/ source now contains
 <opensearch:itemsPerPage>50&quot;'&lt;h1&gt;test&lt;/h1&gt;</opensearch:itemsPerPage>

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 682e706a4ac10b416b51bdb1ea8894dbe21b345e)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 7143: Cleaning up docs/history.txt

Sorting some lines on date
Typo on date for Bernardo Kriegel
Splitting one line in 2008 in two lines
Replacing some tabs with spaces in October 2013

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
No typos or problems found.

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 72b8267c3ff412d7c7927bade83f39ea46df519b)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 10809: use branches template plugin in serials search

In serials-search.pl, branch name was computed using branch code and
then passed to template.

This patch uses the new template plugin now for this:
    Koha::Template::Plugin::Branches.

Test plan :
- Go to serials search
- Perform a search that returns at least an open an a closed subscription having a branch defined
=> The branch name is displayed in "Library" column

Signed-off-by: Pierre Angot <tredok.pierre@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 7ca790997ed6adebb7edafc04b6f1aa136ce7cc2)
Signed-off-by: Fridolin SOMERS <fridolin.somers@biblibre.com>
(cherry picked from commit c397efcfe442bf09bb5f5902b9ac921ac4c902bc)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 11245: fix typo in modborrowers.tt javascript string

In modborrowers.tt, Bug 8986 made the javascript strings translatable:
  _("This attribute will be only applied to the patron\'s category")

In this case, the backslash is useless.

Test plan :
- Create a borrower attribute with a "Category" defined
- Go to Tools / Batch patrons modification
- Enter a cardnumber and submit
- Next to "Attribute", select the borrower attribute you created
=> You see a grey text at the right : This attribute will be only
   applied to the patron's category "XXX"

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 2a4fa0a80307bf61a82a180220504c633000db7f)
Signed-off-by: Fridolin SOMERS <fridolin.somers@biblibre.com>
(cherry picked from commit 8a5e370bc1842093fe2165e3ddd2c50f8616e943)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 10996: Allow numeric subfields to be stripped on export

Regex assumed all numeric characters were part of the tag number
This is obviously false as $9 would be a likely candidate
to be removed on export.

The code can be any printing ascii character other than space
according to LoC's website.

Also changed regexp to no longer allow a zero length tag number
which is nonsensical.

The old regex would accept shorter than 3 digit tags but these were
not stripped so I've removed that option, considering it a bug
not a feature

NB assumption that the code makes that a tag is always numeric is
incorrect but works in practice. Handling non-numeric tags is
a 'To be done'

Made code dependent on the regex succeeding. Picking up results
from a previous regex on failure can lead to weird hard to
identify bugs

In the course of testing Paola Rossi <paola.rossi@cineca.it>
spotted that the delete operation was flawed, only removing
the first occurence of the specified tag/tag subfield. Reworked
the delete loop to operate on all occurences

Signed-off-by: Paola Rossi <paola.rossi@cineca.it>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 248283fc29b46f59c56769a14f8d811cc61834ff)
Signed-off-by: Fridolin SOMERS <fridolin.somers@biblibre.com>
(cherry picked from commit 28d1d74c16be3ac28c51a619ede8567e06a02a27)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 11061: remove unused routine Koha::Calendar::_mock_init

Bug 9209 removes the only occurrence to Koha::Calendar::_mock_init
The routine can be removed.

Test plan:
prove t/Calendar.t

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
I left that routine because I planned to do a follow-up for that so the
Calendar patch series was pushed soon. Nice catch Jonathan, works as expected.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Passes koha-qa.pl, t and xt

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 55b13c092a6b4a1d1e89e08837e2f0c1d2bb84b9)
Signed-off-by: Fridolin SOMERS <fridolin.somers@biblibre.com>
(cherry picked from commit 88959bcd111bcc8499c8fddc56f7a4bf5189af46)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 11146: Show a go back link on no permission page

When a user does not have permissions for a page or module, the
authentication page is displayed with message

  "Error: You do not have permission to access this page.".

Most librarians uses the "previous page" button of their browser to
come back on the page they were before trying to get to the
non-permitted page.

This patch adds a button to help coming back to previous page.
It also changes the "Click to log out" link as a button.

Test plan :
- Define a user with staff permissions but no permission on tools module
- Login with this user
=> You get to intranet home page
- Edit URL to go to tools module : cgi-bin/koha/tools/tools-home.pl
=> You get a page with a red error message and 2 buttons "Previous page"
   and "Log out"
- Click on "Previous page"
=> Go get to intranet home page
- Edit URL to go to tools module : cgi-bin/koha/tools/tools-home.pl
- Click on "Log out" button
=> You are logged-out and get to authentication page : cgi-bin/koha/mainpage.pl?logout.x=1

Signed-off-by: Garming Sam <garming@catalyst.net.nz>

Works as intended.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit d1bec841428de08402628e21b75f7fc6c6e0c361)
Signed-off-by: Fridolin SOMERS <fridolin.somers@biblibre.com>
(cherry picked from commit 1afd62e5c216a1f6cbf366dce04f5d262d9ec270)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 7491: improve description of the item-level_itypes syspref

Adding some text to the pref description referring to OPAC display.

Test plan:
Look at the new description in Cataloging preferences.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 5dcf1857dac7d4c4a75a4e630938b8462542bcf3)
Signed-off-by: Fridolin SOMERS <fridolin.somers@biblibre.com>
(cherry picked from commit 735b7ea1909c7f3cf45855fc54931d837459f20e)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 11222: fix crash that can occur in search for items to add to label batch

This patch fixes a regression on label-item-search.pl introduced by
the patch for bug 9239 where searching for items to add to a label
batch fails with an error if QueryParser is not enabled and you use
the "Added on or before date" search option.

Test plan:

0) Set "UseQueryParser" to "do not try"
1) Start with an installation with bibliografic data and items
   information.
2) Check that in items there are values inside Accession Date

Without the patch:
a) Go in Home› Tools› Labels  and click on 'New batch'
b) Click on 'Add Item(s)'
c) Try to select items with option "Added on or before date"
d) You will receive an error

With the patch:
Try steps a),b), and c)
Now you don't receive an error and you can select items

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Added a description of the problem and copied the test plan from the bug
report, with the addition of the information that QueryParser must be
off to confirm and test.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 69c42067ced1da3821e8a893c76c2f1f1195f946)
Signed-off-by: Fridolin SOMERS <fridolin.somers@biblibre.com>
(cherry picked from commit 8a6215c8c789c4c3044d08ab83f3353cd857a055)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Followed the test plan and the patch fixed the issue.
Bug 11125: Correct display for patron messaging preferences on OPAC

 To test :
 1) Remove 'sms' from message_transport_types table
 2) Go on OPAC "My messaging" tab => table columns are out of alignment with table heading
 3) Apply patch => table is correctly displaid

Signed-off-by: Koha team AMU <koha.aixmarseille@gmail.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 7021d36d0e58fe2acd0ae4ee7c9e658df2cc74be)
Signed-off-by: Fridolin SOMERS <fridolin.somers@biblibre.com>
(cherry picked from commit 3e19537355c22b32cb6f3fda08ec64a5c04f4251)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 11275: make deleteditems.materials be of type text

Bug 7278 has made items.materials of type text.
It must be the same in deleteditems column.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Passes all tests and QA script.
Tested:
- definition of materials now matches between items and deleteditems
- database update works correctly

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
The only difference between tables items and deleteditems is
deleteditems.marc
Amended patch: Add a missing SetVersion in updatedb.pl

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 8aa6e51b6f684f98077dd1c3df1f847bef8d40ba)
Signed-off-by: Fridolin SOMERS <fridolin.somers@biblibre.com>
(cherry picked from commit e312ac25eae6b436c5ad71a2493520b5b5600564)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
DBRev 3.12.07.001

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 11105: wrap places OPAC facet in a span

prog-only OPAC patch.

To test:
Verify places in the facets is wrapped in a span.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Template change only, works as expected.

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit a9900b0d35bcd27483355f19985a9669e1c884e2)
Signed-off-by: Fridolin SOMERS <fridolin.somers@biblibre.com>
(cherry picked from commit 98efa9bcc1048474176d04443eb6d6f9338c52b1)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 7484: keep selected values when changing search type on authority search form

1) I'm on the "Search authorities" tab. I select an authority type,
   then change the active tab. The type change is lost.
2) I'm on a tab and type a search pattern, then change tab, the string
   is lost.

This behaviour is logical, given the fact that we're using tabs, but it
would be more practical to keep the typed informations when the user
changes the search mode.

This patch add a few JQuery code to synchronise inputs between all
tabbed authorities search forms.

Test plan :
- Go to Authorities home page : cgi-bin/koha/authorities/authorities-home.pl
- In toolbar, "Search main heading" is selected
- Change all inputs : authotity type, operator, term, and sort order
- Click on "Search all headings" tab
=>  Inputs are the same has previous tab
- Click on "Keyword search" tab
=>  Inputs are the same has previous tab

Signed-off-by: Paola Rossi <paola.rossi@cineca.it>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Amended patch: Explicitly declare 2 new variables used.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Passes all tests and QA script.
Works as described, Firebug doesn't show any problems with
the Javascript.
Could be useful for other tabbed searches like the start page
as well.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 85642ededaf71b0a67805151937014f42deea2dd)
Signed-off-by: Fridolin SOMERS <fridolin.somers@biblibre.com>
(cherry picked from commit 32277e0669c86c972117bd62b92bbad2dab4e5c5)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 11183: get rid of some log noise from the OPAC

To test in OPAC:
* With the OPAC System Preference EnableOpacSearchHistory set
  to Keep, a simple search triggers the warning patched on
  line 626 of opac-search.pl
* Selecting a search result item with no Collection Code
  set triggers the warning patched on line 576 of opac-detail.pl
* Have an item with Collection Code. Check that the Collection
  Code shows.
* Collection Code is set by editing an item in the staff client
  (952$8)

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit ec206d18980b2438cfe3da9e89455eda319dd8d7)
Signed-off-by: Fridolin SOMERS <fridolin.somers@biblibre.com>
(cherry picked from commit dc919cac9c62111ab38a6f1bdb7abfb9a38ee8c5)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 11242: fix opac-MARCdetail.pl display and warnings

This patch improves the public catalog MARC view display
of records that contain subfields that are not defined in
the framework used by the bib record.

To test:

(RM note: it may be easier to find or create a MARC record that
 contains a subfield not present in the default framework, then
 load it, rather than fiddle with the MARC frameworks in your
 test database.)

BACK UP YOUR DATABASE!
 1) Search for an item in OPAC
 2) Open OPAC detail
 3) Click 'MARC View' link
 4) Look for something with multiple lines (e.g. 260 or 942)
 5) In another tab, Go to staff client and log in
 6) Go to the staff client URL similar to:
     /cgi-bin/koha/catalogue/detail.pl?biblionumber=##### page
    where ##### is the biblionumber.
 7) Edit -> record
 8) Note the framework used.
 9) More -> Administration
10) MARC bibliographic frameworks
11) Click 'MARC structure' for the framework used by the item
     shown in OPAC.
12) Find the tag (e.g. 260 or 942) and click 'Subfields'
13) Delete of the matching subfields (e.g. 260$b) shown in the
     OPAC tab
14) Clear your opac error log.
15) Refresh OPAC tab. The tag subfields are split.
16) There are opac-MARCdetail.pl warnings.
17) Apply patch
18) Clear your opac error log.
19) Refresh OPAC tab. The tag subfields are no longer split strangely.
20) There are no opac-MARCdetail.pl warnings.
RESTORE YOUR DATABASE.

This also silences a series of warnings triggered by catching
undef hash references.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 38503e18a38116646c9746b13f013b3c11fe55c1)
Signed-off-by: Fridolin SOMERS <fridolin.somers@biblibre.com>
(cherry picked from commit e8d988cc036a0633e19cf0843aa6daa7fddcedd1)
Bug 11059: fix date sorting of import batches in basket add form

This patch improves the sorting of staged import batches by date,
particularly when the dateformat system preference is set to anything
other than YYYY-MM-DD.

Adds title-string sorting type to enable this.

To test:

[1] Ensure that there are at least three staged
    bib import batches, with upload timestamps such that
    date sorting errors would be apparent.
[2] Set the dateformat system preference to either DD/MM/YYYY
    or MM/DD/YYYY.
[3] Create a new basket in acquisitions, then chose to add
    a new order line from a staged record batch.
[4] In the list of batches, click on the 'staged' column
    heading to sort by date.
[5] Observe that dates are sorted in alphanumeric order, not date
    order.
[6] Apply the patch and refresh.  This time, dates should sort
    correctly.

Signed-off-by: Fridolyn SOMERS <fridolyn.somers@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 097a92b3188d62e9797d18313715c35d9dc186b4)
Signed-off-by: Fridolin SOMERS <fridolin.somers@biblibre.com>
(cherry picked from commit 2ffdd4c341c3bb175134eca06db0e204d46988af)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 11059: (follow-up) restore time in staged dates in addorderiso2709.tt

Follow-up patch to restore the display of time in
acqui/addorderiso2709.tt in staged date.
Simply uses an option of KohaDates TT plugin.
This time may be useful if there where several imports in the same day.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit cfa0dc1aedf3a280f98b9a1728853a6041f59af5)
Signed-off-by: Fridolin SOMERS <fridolin.somers@biblibre.com>
(cherry picked from commit b40abcb16593fdb23c54b942e3a152ccbdf1c3ff)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 11322: fix XSS bug in purchase suggestions pages

To test
1/ Switch on purchase suggestions
2/ On the public interface (OPAC) add a suggestion, put html in every
field
3/ In the staff interface go to the suggestions page
/cgi-bin/koha/suggestion/suggestion.pl
4/ Notice the html is rendered
5/ Click on a suggestion, notice the html is rendered on the show page
also
6/ Apply the patch, check these two pages again, html should now be
escaped

Signed-off-by: David Cook <dcook@prosentient.com.au>

Works as described.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Passes all tests, thx Chris!

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 368068c71597eaf61e4f9cc154002ea92dfd16c3)
Signed-off-by: Fridolin SOMERS <fridolin.somers@biblibre.com>
(cherry picked from commit f8278987e3e1bac23e968417728a821faa22aa57)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>