Bug 13377: mark automatic_renewals.pl as executable

This script is called by a cron job, but was never marked as executable,
so will error every time it's called, which is no good. This also adds
an appropriate #! line to the top of the file.

To test:
* apply the patch
* make a package
* ensure that the installed
  /usr/share/koha/bin/cronjobs/automatic_renewals.pl
  is mode 755 and does something when run.

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 12839: aqbooksellers.gstreg is never used

The aqbooksellers.gstreg is never used in the code.
This patch does not remove the DB field but 3 useless occurrences in the
neworderempty page.

The both variable applygst and gstreg have never been took into account for prices calculation.

Test plan:
Verify there is no difference before and after the patch in the prices
calculation.

Signed-off-by: Paola Rossi <paola.rossi@cineca.it>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 12841: aqorders fields should not be mapped

Bug 5336 introduced some code which should have been introduced by bug
7294.
Since the idea behind bug 7294 has been abandoned (map the aqorders
fields), the code can be removed.

Test plan:
Verify that Koha does not allow you to map the aqorders fields with a
MARC subfield.
Verify there is no regression on adding/updating an order.

Signed-off-by: Zeno Tajoli <z.tajoli@cineca.it>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 12980: GetHistory does useless processing

GetHistory iterated on the orders to calculate the quantity and price.
These values are never used by the called.
It can be removed.

Test plan:
Verify there is no regression on acqui/histsearch.pl and
catalogue/detail.pl
Actually you just have to check that the total quantity and price are
not displayed on these views.

QA: note that 'count' and 'toggle' are never used in the template.

Signed-off-by: Paola Rossi <paola.rossi@cineca.it>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 12852: The "preview" param can be removed serials/claims.pl

This case (preview=1) never appened. This patch remove all occurrences
in the pl and the tt files.

Test plan:
Verify you don't manage to find a place where preview is set to 1 on the
claim serials page.

Signed-off-by: Paola Rossi <paola.rossi@cineca.it>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 12852: Some unused stuffs more

These parameters are never used.
GetBookSeller takes a string (bookseller name) in parameter, not an id!

Signed-off-by: Paola Rossi <paola.rossi@cineca.it>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 12852: C4::Bookseller should not be imported anymore

This script does not depend on C4::Bookseller anymore. The import can be
removed.

Signed-off-by: Paola Rossi <paola.rossi@cineca.it>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 12123 - [Alternative patch] HTML notices can break the notice viewer

Depending on the content of an html notice, it can cause the notice to
either not be collapsible, be uncollapsible, or to be permanently
collapsed.

Test Plan:
1) Set your CHECKOUT notice to the following ( with HTML Message checked ) :
<p>The following items have been checked out:</p>

----
<blockquote> <<biblio.title>> </blockquote>
----

<p>Thank you for visiting the <<branches.branchname>> of HMCPL.</p>
2) Check out some items to a patron
3) View the patrn's notices
4) Note the notice viewer is broken ( message is not collapsed, and
   con't be collapsed ).
5) Apply this patch
6) Reload the page
7) Note the notice viewer is no longer broken

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

This patch appears to fix the problem with the minimum required change.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Works nicely, no problems found.
Passes tests and QA script.

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
DBRev 3.19.00.000: keep moving

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 13425 - XSS in opac facets - Patch for master and 3.18

To Test
1/ Craft a url like /cgi-bin/koha/opac-search.pl?q=123&sort_by='"><script>prompt('Happy_Holidays')</script>&limit=123

It is important it must return results and facets

2/ Notice the js is executed
3/ Apply the patch test again

Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>
Popup is gone after applying the patch. Facet link still shows it but does not execute. It's gone after clicking the link.

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>