Bug 11660: remove disused tools/pdfViewer.pl

tools/pdfViewer.pl can be used to read artibrary files on the system.

It is actually an unused file, so leaving it around serves no purpose
and is dangerous.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
No regressions found.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit d1b6e0646fd6a70f6724189554e80aaa68aec64b)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 11661: sanitize file names supplied to edithelp.pl

This patch corrects an issue whereby edithelp.pl could
be used to create or modify arbitrary files on the server
with the permissions of the Apache user.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 7baf02c263a627b1454577b3141a0af4b8f963d1)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 11662: remove disused member-picupload.pl

This script is no longer used, and in addition has problematic
handling of its parameters that could lead to writing to
arbitrary files on the server.

To test:

[1] Verify that member-picupload.pl is no longer referred
    to in the codebase after applying this patch.
[2] Verify that there are no regressions in patron
    photo management.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Found no regressions in removing this script.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 939079de756fdda1ca8f62c48efe0e2e3034ae32)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 11666: add permission check for MARC framework import/export

This patch makes the MARC framework import/export script require
that the staff user be logged in with appropriate permissions for
managing the MARC frameworks.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

I can confirm the bug and the solution. After applying the patch
downloading the file without logging in first is no longer possible.
Also passes tests and QA script.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 03d4ed2468bb9ab97b1f7b7d9e29507dc815a8b3)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 11666: remove SQL as an option for MARC framework exports and imports

The SQL option for MARC framework imports was subject to a bug whereby
somebody could use it to gain access to arbitrary information in the
database by uploading an SQL file containing unexpected statements.

As it is difficult to securely sanitize SQL, this patch removes the
option to use SQL as an import or export format.

To test:

[1] Verify that SQL no longer appears as an import or export option
    for the MARC frameworks.
[2] Verify that exports and imports in CSV, Excel XML, and ODS formats
    still work.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Works as advertised. The UI doesn't offer exporting/importing in the SQL format.
Crafting the URL to export SQL fallbacks to a spreadsheet format (ODS).

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Works as described, passes all tests and QA script.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 94e349ff6ce4a1abb313102decc12429d02dfb4b)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
There were conflicts on the template. The modified strings wont get translated
but in as it is an administrative feature that not everyone uses on a daily basis
I think it wont hurt. And will get fixed in a couple of weeks anyway.
Update release notes for 3.12.10 release

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Increment version for 3.12.10 release

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 9948: fix creation/updating of items when partially receiving an order

Problem summary: when doing partial receives for the given order -
1) if AcqCreateItem is set to 'ordering', various item data (price,
dateaccessioned, replacementprice, replacementpricedate) are getting
erroneously updated on the wrong (yet to be received == not the ones
being currently received) item records
2) if AcqCreateItem is set to 'receiving', newly received
item records are being created without the aforementioned fields
set to the proper values

This (trivial) patch should deal with both cases, hopefully without
breaking enything else.

To test:
- apply the patch,
- create some orders with 2+ quantity
- test partial & non-partial receives for those orders
- ensure the received item records are getting modified
(for AcqCreateItem set to 'ordering') and/or created (for AcqCreateItem
set to 'receiving') correctly for both partial and non-partial receives
- receiving orders with quantity = 1 / receiving orders in non-partial
mode should be still working fine for 1) & 2) scenarios (i.e.,
AcqCreateItem set to 'ordering' / AcqCreateItem set to 'receiving')

Signed-off-by: Nicole C. Engard <nengard@bywatersolutions.com>

Works as I'd expect now! Awesome patch.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Passes all tests and QA script.
Also: t/db_dependent/Acquisition/
      t/db_dependent/Acquisition.t

Created 2 orders with 3 items each for both settings
of AcqCreateItem (on receive, on order) with the patches
applied. No regressions found.

Closed baskets and received shipments for each, with
AcqCreateItem set according to how the order was created.

First recreated the problem without the patches, reloaded
database and confirmed that the patch fixes it.

No problems found.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 95e2754af6a2dbd5f042a1c3504488f5de8c8d23)
Signed-off-by: Fridolin SOMERS <fridolin.somers@biblibre.com>
(cherry picked from commit 7f57015aa99c9a99cf5d0715f9c55222941c1c27)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 10453: fix unintended password reset when updating child to adult

ModMember supposes the password given in parameter is the
password string, so if it receives the encrypted password,
it will encrypt it again! By simply deleting the password key
from the hash, ModMember leaves the password unchanged.

Test plan:
1/ Create or choose a child patron
2/ Update it to an adult category using the
   "Update child to adult patron" link
3/ Try to log in at the OPAC with this patron: It is not
   possible, the password has changed
4/ Apply the patch and try again previous steps

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Confirmed the problem and tested the patch fixes it.
Passes all tests and QA script.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 3c5b4712717d082b66376915c47b6b5880695d31)
Signed-off-by: Fridolin SOMERS <fridolin.somers@biblibre.com>
(cherry picked from commit 810168643d02ebb69c2d56a5fa17b811b06d68a8)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 11412: fix potential bulkmarcimport crash when searching for duplicates in authorities

bulkmarcimport.pl can crash when searching for duplicates if the 005
field from the incoming or local record is not defined. This patch
fixes it.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Test plan
1/ Create a record with no 005 field
2/ Try to import it checking for duplicates, notice it crashes
3/ Try with a record with a 005 field, but the one in Koha missing
one, still crashes
4/ Apply patch
5/ No more crash

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Passes all tests and QA script.
Patch fixes the problem described for importing authorities
with the bulkmarcimport.pl when trying to match with existing
records.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 28d97e322805a42680527232b151754b4778aed8)
Signed-off-by: Fridolin SOMERS <fridolin.somers@biblibre.com>
(cherry picked from commit 16df6d75044a6b1d64bb0ab4f0bded4b4699d5d6)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 11419: display Z39.50 search errors more completely

When a z39.50 server isn't able to be searched successfully, the yellow
error box came up empty.  This patch fixes the problem.

Test Plan:
1) Go to Administration/z39.50 servers
2) Create a fake z39.50 server with a made up address
3) Go to cataloging, search only that server
4) Note the empty yellow alert box
5) Apply this patch
6) Re-run the search, not the alert box has a message in it now

Signed-off-by: Nora Blake <nblake@masslibsystem.org>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Passes all tests and QA script.
Works according to test plan.
When one of the selected servers gives result no dialog
box is shown before and after applying the patch.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 0fc114eee3f649abea88a62502211c595c2867b8)
Signed-off-by: Fridolin SOMERS <fridolin.somers@biblibre.com>
(cherry picked from commit 0c4e9a01544d898db10e704aea15633d689311be)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 8018: MARC framework max subfield length should default to 9999

The default value for the marc_subfield_structure.maxlenght is 9999
in the DB. Currently the template passes an empty value which is casted to
0 by the CGI.

This simple patch validates the input and converts to the default (9999)
if not defined or 0.

Another approach could be changing the 9999 default and/or treating 0 as
'no-limit'.

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Works by defaulting 0 or "" to 9999.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 1ebbf40ecc07b9474e81e20ec1598659ab027d7a)
Signed-off-by: Fridolin SOMERS <fridolin.somers@biblibre.com>
(cherry picked from commit a3f0eb97697213a267de0f8191e2acbc4197f6ab)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 8018: (followup) make the default more explicit

This patch:
- Makes the new subfield tab show maxlength=9999 as default (instead of
  empty-then-zero).
- Updates the help to make exlpicit that 0 or empty defaults to 9999.
- Assumes all the subfields created with maxlength=0 inadvertedly are
  meant to mean "no limit" and hence update the database to reflect
  that.

To test (this patch and Pablo's):
- Edit a MARC framework, edit some field's subfields.
- Use the 'New' tab to create a new subfield (choose an unused letter).
- See in "More constrains" that the "Max length" field is empty. Leave
  it as-is.
- Save the changes (the new subfield).
- Edit the field again, verify that "Max length" is 0.
- Try tu use the framework and the the field/subfield just created
  > FAIL
- Apply the patches, upgrade
- Try to use the framework/field/subfield > SUCCESS (0 was converted to
  9999)
- Repeat from the begining, "Max length" should show 9999 on the new
  subfield tab.
- Leave it empty, it is saved as 9999.

Edit: small typo

Sponsored-by: Universidad Nacionald de Cordoba
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Passes QA script and tests in t and xt.
Tested:
- deleting an existing subfield
- adding a new subfield with new default 9999
- editing the new subfield, changing value to 8888
- deleting new subfield
- adding new subfield, using 8888 as length

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit b5eab7c20bb8c2d07966bf1f68eaf0a7f953222e)
Signed-off-by: Fridolin SOMERS <fridolin.somers@biblibre.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>

Conflicts:
	installer/data/mysql/updatedatabase.pl

(cherry picked from commit 828d9b9f20fa4f01b6fb6bd4d9ff20d674f3ceac)
Bug 8018: (follow-up) fixing some wrong capitalization

Fixes capitalization in 2 places:

- Delete a subfield - Yes/No options
- Edit a subfield - Edit subfield

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 3b9d8074b85b7d06c555491a75a48ac751560ec2)
Signed-off-by: Fridolin SOMERS <fridolin.somers@biblibre.com>
(cherry picked from commit bbc101bb1cb6705ea518b5f4fbd786393c643c22)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
DBRev 3.12.10.001

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 7518: regression test double-quote in search operand

Under certain circumstances, namely where QueryParser is off,
QueryWeightFields is on, and QueryFuzzy and QueryAutoTruncate are
off, a search with a double-quote embedded in it can fail: for
example

    web application

would return results where

    web "application

does not.

This patch adds an automated regression test.

To test:

[1] Apply this patch and run prove -v t/db_dependent/Search.t;
    two tests should fail.
[2] After applying the main patch that fixes the bug, the
    prove -v  t/db_dependent/Search.t should succeed.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 437f06624759c464d667107d9f73ec05283f6892)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 895f989dcaad44830bc85d855d71b654170dbb1d)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Fixed some conflicts, the tests are they same overall.
Bug 7518: certain searches with quotation marks don't work

Under certain circumstance, a search term without quotation marks
returns the expected results while the same search with a
double quote embedded in it would fail.

Koha should ignore the quotation marks and return results anyway.

This appears when  QueryWeightFields syspref is activated (and
QueryAutoTruncate is off), as field weighting builds a complex CCL
query using double quotes around search words.  This patch simply
replaces double quotes in search words by a space.

Test plan :
- Set QueryAutoTruncate off (you may also need to set QueryFuzzy to off)
- Set QueryWeightFields off
- Perform a serch on two words where you have results, like : centre "ville
=> you get results
- Set QueryWeightFields on
- Perform same serch
=> you get the same results

Signed-off-by: Leila <koha.aixmarseille@gmail.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 868855df4b674b495966c022392068c2fdd3a35f)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit f1bb46172bdc90db00a08c2c78e169952fd22feb)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 11279: regression test for picking random quote

This patch adds new tests based on the db_dependent tests in
t/db_dependent/Koha.t for GetDailyQuote().

Tests run on an empty database and don't require Test::Deep.

Tests will fail before applying the patch for 11297, but will
pass after applying the patch.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit f874eec0793f83c3c0f1461fecb878ca57ed701b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 252051df7378d1d23e726a8757efb4e6af22d1fa)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 11279: Improve how a new quote of the day is selected

If there is a gap in the id sequence for the quotes table, it
is possible that no new quote will be selected. This will happen
particularly when a lot of the older quotes with low ids have been
deleted.

This patch improves the selection of a new quote.

To test:
- Load sample quotes
- Delete the first half of the quotes.
  Note: With 34 quotes, delete the quotes with ids from 1-17
- Activate the QuoteOfTheDay system preference
- Check if a quote is displayed in OPAC
- Reload the page a few times, no quote should be displayed
  Note: make sure you don't have a quote with the current
  date in your quotes table before running those tests
- Run 'perl t/db_dependent/Koha.t'
  Note: requires sample quotes!
- Apply patch
- Reload the OPAC start page
- Verify a quote was now picked
- Run 'perl t/db/dependent/Koha.t' again - all tests should still pass

Signed-off-by: Galen Charlton <gmc@esilibrary.com>

Patch modified to use "LIMIT 1 OFFSET ?" rather than "LIMIT ?, 1"; the
latter construction does not work in PostgreSQL.

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 5a3db23362eb076a2f6d5a87f87b29f4a436a14f)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit ae55277499f06ae0d3e2973349d1f34cf7f60ec8)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 11279: (follow-up) remove unnecessary check on number of quotes

It is not necessary to process the case where the number of quotes
is just one, as int(rand(1)) will always produce 0, which is a valid
offset.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 8ee6e4290e2d1ca4fea53363b7ca3275cb0e6f58)
(cherry picked from commit bff4fac7b78fe8573527c8733f8364af351d23a9)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>