Bug 10590 - in opac-topissues limit param is not protected

In opac-topissues page, the limit URL argument is directly added to SQL query.

This patch adds protections : limit must only contain digits and must be lower than 100.

Test plan :
- Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=10&branch=&itemtype=&timeLimit=999&do_it=1
=> You get the results of 10 most cheched-out of all time
- Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=&branch=&itemtype=&timeLimit=999&do_it=1
=> You get the results of 10 most cheched-out of all time
- Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=9999&branch=&itemtype=&timeLimit=999&do_it=1
=> You get the results of 100 most cheched-out of all time
- Edit URL to : /cgi-bin/koha/opac-topissues.pl?limit=WHERE&branch=&itemtype=&timeLimit=999&do_it=1
=> You get the results of 10 most cheched-out of all time

Signed-off-by: Robin Sheat <robin@catalyst.net.nz>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 10590 - parameterise the limit option

The limit option was previously substituted directly into the query. The
previous patch on bug 10590 filters it on input, but there's no reason
not to have it made to work properly in the query for added safety.

To test:

[1] Go to the top checkouts report (http://OPAC/cgi-bin/koha/opac-topissues.pl)
[2] Run the report several times, varying the filters on
    number of results and item type.
[3] Verify the the list of top checkouts appears to be correct.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 10504: Remove the unused C4::Acq::ModOrderItem routine

This routine has been introduced by commit 2d90fb22d43db986547bbaa945873d6dd78aab71.
The only call has been removed by commit 9eba7dc594fc0d4698da5e791d5f6f8682b2712a.

So now, this routine is useless.

Signed-off-by: Srdjan <srdjan@catalyst.net.nz>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 10447: add 'ru' and 'uk' to Zebra indexing language list

This patch add the option to choose 'ru' and 'uk' during install for Zebra.
Should work for a tarball install, and make 'ru' and 'uk' available for using
with koha-create too.

Sponsored-by: Universidad Nacional de Córdoba
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Reran Makefile.pl and made sure the language options show up now.
Patch extends existing language code lists addings nb, ru and uk
where missing.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 9770: test case for sorting of Dewey call numbers that contain prefixes

This adds a test for C4::ClassSortRoutine::Dewey to check that the
call number "JR DVD 800.1" sorts before "JR DVD 900"

To test:

[1] Apply just this patch.
[1] Run prove -v t/ClassSortRoutine_Dewey.t
[2] Test #7 should fail.

Signed-off-by: Jason Etheridge <jason@esilibrary.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Passes test plan and QA script.
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 9770: fix sorting of Dewey call numbers that contain prefixes

C4::ClassSortRoutine::Dewey can pad the wrong part of a call number internally.

The subroutine get_class_sort_key tokenizes a call number string (splitting on
periods and whitespace) and counts the number of tokens that solely contain
digits.  If there is only one such digit group, a comment in the code states
that it will pad said digit group.  However, the bug is that the code assumes
said digit group is the first token, when this may not be the case.

In practice, this can cause poor sorting when used a call number is in the form
of PREFIX _space_ 3DIGITS.

To test:

[1] Create two item records whose class scheme is set to
    'ddc' (Dewey) and whose call numbers contain prefixes, e.g.,
    J DVD 700.1 ABC and J DVD 850 DEF.
[2] Use the inventory tool to produce a list of item items that include
    the two created in step 1.  Obsere that that items are sorted
    in the incorrect order, with "J DVD 850 DEF" coming before
    "J DVD 700.1 ABC".  Alternatively, run the following SQL
    to see the incorrect sort order:

    SELECT cn_sort, itemcallnumber
    FROM items
    WHERE itemcallnumber LIKE 'J DVD%'
    ORDER BY cn_sort;

[4] Apply this patch.
[5] Run misc/maintenance/touch_all_items.pl to force cn_sort to be
    recalculated.
[6] Repeat step 2 and verify that the call numbers are now sorted
    corrected.

Signed-off-by: Jason Etheridge <jason@esilibrary.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 10258: fix permissions check for setting basket group for order basket

Improve the code that displays and allows staff to
set the basket group from the basket details page
for a closed basket.

Prior to this patch, a staff member who did not
have the group_manage acquisition permission would
still see a control to change the group that the
basket belongs to; attempting to change the group
would present with with a login page.

This patch also does some tidying of how basket group
details are passed to the template.

To test:

[1] Create an order basket and close it.  Do
    not assign it to a basket group.
[2] View the basket details while logged in as
    a staff user who has the order_manage acquisitions
    permission but not the group_manage.  The
    displayed basket group should be "No group".
[3] Switch to a staff user who also has the
    group_manage permission, then view the basket
    details again.  The basket group field should
    now be a select input that allows you to change
    the basket group.
[4] Change the basket group.  Verify that the basket group
    you selected is now displayed as the current group
    for that order basket.  The basket group delivery and
    billing place fields should also now be displayed.
[5] Close the basket group set in the previous step, then
    view the basket details again.  This time, the basket
    group name should be displayed with a suffix of " (closed)",
    and no input to change the group should be displayed.
[6] Swith to a staff user who does not have the group_manage
    permission, view the basket details, and verify that
    the basket name is displayed with a suffix of " (closed)".

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 10258: offer to create basket group only when staff user has correct permission

If the staff user does not have the group_manage acquisition permission,
do not offer to create a new basket group when closing an order basket.

This avoids a situation where if a staff member without that permission tries
to close a basket and chose the option to create a bakset group, they would
be redirected to the login page.

To test:

[1] Log in as a staff user that does not have
    the acquisition/group_manage permission.
[2] Create a new order basket, attach at least one
    order line to it, then close it.
[3] Verify that the confirmation page does not
    offer to create a basket group with the
    same name as the order basket.
[4] Log in as a staff user that has the
    acquisition/group_manage permission.
[5] Create and close an order basket.
[6] Verify that this time, the confirmation page
    *does* offer to create a basket group.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>