Bug 9032: add ability to invite another to share a private list

This patch

- Adds a Share button for OPAC private lists.
- Allows you to send an invitation to share a list.
- Checks on validity of email addresses (with Email::Valid).

Test plan:
1) Sharing depends on syspref and login.
Toggle the pref OpacAllowSharingPrivateList.
If enabled, you should see the Share button in OPAC/Private lists.
Click on the Share button. You should get Share a list.
Logout and try to go back to opac/opac-shareshelf.pl
It should now present you the login form.

2) Try to share a public list or a list you do not own.
Find a security hole in the interface. Or hack the shareshelf URL and
replace the shelfnumber with a public list number.

3) Enter no email address or invalid ones (no domain, forbidden chars).
If you enter no address, submit should not work.
If you enter only wrong addresses (separated by: ,:; ), you get a
message.

4) Test if sending the invitation works.
Share one of your private lists. Enter your own email address.
After your proc_message_queue cronjob ran, you should have an email.
Check also if you see a new record in the virtualshelfshares table.
Note that the followup patch handles the second part of accepting this
share.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Dobrica Pavlinusic <dpavlin@rot13.org>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 9032: (follow-up) add new dependency Email::Valid

Just adds this dependency to PerlDependencies module.
Note from Robin: libemail-valid-perl is in squeeze already.

Test plan:
You should see Email::Valid now under About/Perl modules.
If Email::Valid is not yet installed on your system, please do so.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Dobrica Pavlinusic <dpavlin@rot13.org>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 9032: (follow-up) adjust the "share a list" template

This patch makes a few changes to the "share a list" template:

- We don't use tables for layout of forms. This patch corrects the
  display of the share form to use Koha standard form markup.
- Revise the confirmation message displayed after a list is shared to be
  more readable.
- Add a link back to private lists to the confirmation message.
- Add T:T markup to make this page display the left-hand navigation
  which is shown on other patron-related pages when a user is logged in.

To test, apply this patch on top of other patches pending for Bug 9032
and confirm that the list share form looks correct and works correctly.
Confirm that share confirmation page reads well.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Dobrica Pavlinusic <dpavlin@rot13.org>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 9032: (follow-up) Plackify opac-shareshelf.pl

Plackified opac-shareshelf by moving global my variables into hashref
and explicitly passing paramters to the subroutines that
opac-shareshelf.pl uses.

Slightly changed base64ord and base64chr functions to more generic ones.

This patch also corrects the version of the GPL statement.

Test plan:
Verify if sending an share invitation still works (under prog theme).

Signed-off-by: Dobrica Pavlinusic <dpavlin@rot13.org>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 9032: add ability to accept list share invitations and remove shares

This patch handles:

[1] The response (acceptance) by the invited person.

If the person accepts this share, the private list of the sender will
be shown under Your lists on the shelves page. In OPAC 'Your private
lists' has been renamed to Your lists (just as in Staff). The Type
column shows Private or Shared for these lists; a list appears as
Shared as soon as an invitation has been accepted. The owner has the
options to Edit, Delete or Share; the invited person does not have
these options on the shared list.

[2] Removing an accepted share.

If a user accepted a share, they should also be able to remove it again.
The Remove Share button is visible on OPAC when viewing Your lists or
a particular shared list.

Note: AddShare has been extended to return a possible database error.
If the share invite could not be added, a mail will not be sent.

Test plan (for prog theme):
Enable pref OpacAllowSharingPrivateLists
User 1 creates new private list P1, perms: D-A-D, adds 2 items, sends share
User 1 checks your lists display: is P1 Private with Edit button?
User 2 accepts share: sees P1, but cannot add or delete items
User 2 checks your lists display again: P1 shows Shared without Edit?
User 1 checks your lists display again: P1 shows Shared with Edit?
User 2 tries to accept share again: should fail now
User 3 tries to accept share: should also fail
User 3 tries again, modifies shelfnumber and/or key in url: should also fail

User 2 creates new private list P2, perms: A-A-A, no items, sends share
User 2 checks your lists display: P2 shows Private with Edit?
User 1 accepts, adds one item
User 1 checks your lists display: P2 shows Shared without Edit?
User 2 checks your lists display: P2 shows Shared with Edit?
User 2 deletes item of user 1 (allowed)
User 2 deletes list P2
User 1 checks your lists display in opac or staff: P2 is gone?

User 1 creates private list P3, sends a share.
User 1 creates private list P4, adds one item, sends a share.
User 2 accepts the share for P3.
User 2 checks the shelves display, and removes share P3.
User 2 accepts the share for P4.
User 2 views shelf P4 with one item and confirms Remove share on that form.
User 2 checks shelves display again.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Dobrica Pavlinusic <dpavlin@rot13.org>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 9032: Unit tests for sharing lists

This patch combines some work from bugs 10389 and 10441.
With thanks to Srdjan and Jonathan Druart for their contributions.

Adds tests for AddShare, AcceptShare, IsSharedList, RemoveShare.
This patch also restores the inadvertently deleted DelShelf tests
in bug 10499.

Test plan: Run the test VirtualShelves.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Dobrica Pavlinusic <dpavlin@rot13.org>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 9032: enforce consistent behavior when deleting lists

DelShelf deletes a list regardless whether it is private, shared or
public. HandleDelBorrower had another approach, trying to save shared
and public lists by setting the owner to NULL.

This patch makes both routines behave consistently.

A new report 11889 has been opened to discuss the 'disowning' feature.

NOTE: I did not add a db revision here to handle possible cases of lists
without owner in the current data. Such public (or shared) lists can still
be used without any problem. Bug 11889 and a new planned report for a lists
management tool will address this topic further on. After that, all goals
of umbrella report 7310 should be realized.

Test plan:
Create a list P1 with user1 that allows adding by other users.
Add a patron (user2).
Login as user2 and create some lists, add some items.
Let user2 add some entries to P1 too.
Delete patron user2.
Verify that his lists are gone, but his entries in P1 are kept (nullified).

Signed-off-by: Dobrica Pavlinusic <dpavlin@rot13.org>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 9032: (follow-up) add support for bootstrap theme

Adds new template opac-shareshelf.tt.
Modifies template opac-shelves.tt: Share button, Remove Share button,
label "Your lists" instead of "Your private lists", list category
Shared.

Test plan:
Verify if the Share a list-features work in bootstrap by:
[1] Switch to bootstrap. Go to Lists.
[2] Share one of your private lists.
[3] Login as another user and accept the invitation.
[4] Remove the share again.
[5] Check if Share and Remove share do not popup for public lists.

Signed-off-by: Dobrica Pavlinusic <dpavlin@rot13.org>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 9032: new SHARE_INVITE & SHARE_ACCEPT notifications

Adds notices SHARE_INVITE and SHARE_ACCEPT in updatedatabase and
sample_notices.

Test plan:
Install or upgrade and verify that you have the new notice under Tools.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Dobrica Pavlinusic <dpavlin@rot13.org>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 9032: (follow-up): send cookie with redirect

Small fix to resolve a problem Dobrica noted on the bug report: if you
had to log in when accepting the share, the cookie was not passed
back to the server when redirecting to shelf display.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 9032: (follow-up) loop variable and Cancel button

[1] Use loop variable instead of $_ in opac-shareshelf.pl
[2] Adds Cancel button to Invite form (prog and bootstrap) in
    opac-shareshelf.tt.  Likewise adds Return link under an error
    message in opac-shareshelf.tt.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 9032: (follow-up) adding new notices to non-English installer files

Adds the notices SHARE_INVITE and SHARE_ACCEPT to sample_notices.sql for
the foreign language installer files in installer/data/mysql.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
I tested each installer file by deleting all notices from letter, running
the file and counting the records. I did so with and without this patch.
The results below show that in each case two notices were added as
expected. Note that the English file contains 25 notices including the two
new ones.

BEFORE THIS PATCH:
de-DE/mandatory/sample_notices.sql: 23 notices
es-ES/mandatory/sample_notices.sql: 18 notices
fr-FR/1-Obligatoire/sample_notices.sql: 18 notices
it-IT/necessari/notices.sql: 21 notices
nb-NO/1-Obligatorisk/sample_notices.sql: 23 notices
pl-PL/mandatory/sample_notices.sql: 18 notices
ru-RU/mandatory/sample_notices.sql: 18 notices
uk-UA/mandatory/sample_notices.sql: 17 notices

AFTER THIS PATCH:
de-DE/mandatory/sample_notices.sql: 25 notices
es-ES/mandatory/sample_notices.sql: 20 notices
fr-FR/1-Obligatoire/sample_notices.sql: 20 notices
it-IT/necessari/notices.sql: 23 notices
nb-NO/1-Obligatorisk/sample_notices.sql: 25 notices
pl-PL/mandatory/sample_notices.sql: 20 notices
ru-RU/mandatory/sample_notices.sql: 20 notices
uk-UA/mandatory/sample_notices.sql: 19 notices

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 9032: DBrev 3.15.00.035

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 9032: (follow-up) wording tweaks

- "share his list" => "share a list"
- "any valid email" => "a valid email"

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 9032: (follow-up) add libemail-valid-perl as a Debian dependency

Not strictly necessary, but for as long as both debian/control and
debian/control.in are stored in the repo...

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 9032: (follow-up) code tidying

- use Modern::Perl;
- standardize license statement
- run perltidy

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 9032: (follow-up) restore documented intepretation of virtualshelfshares.sharedate

The sharedate column is documented as having the following meaning:

"date of invitation or acceptance of invitation"

This patch adjust the new list-sharing code to stick with that
interpretation, as otherwise the column should have been renamed
to 'invite_expiration_date' or the like.

It also removes the "housekeeping" functionality from AddShare, as
otherwise the routine should have been named AddShareAndDoOtherStuff.

To prevent list shares from piling up, a new --list-invites flag
has been added to cleanup_database.pl.  The default crontabs have
been modified to use the --list-invites flag by default.

To test
-------
[1] Make some list share invites and accept some, but now all of them.
[2] Wait 14 days (or more reasonably, manually edit the sharedate
    values for the unaccepted shares to put them at least 14 days in the
    past.).
[3] Run cleanup_database.pl --list-invites
[4] Verify that accepted shares remain, as to share invites that have
    not yet reached more than 14 days of age.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 9915: Allow sql_params to be passed to a report using the OPAC svc/report interface

Test plan:

1/ Make a public report that contains SQL parameters
2/ Test it from the staff side
3/ Hit the url like
cgi-bin/koha/svc/report?id=1&sql_params=chris&sql_params=chris2
4/ Test you get JSON

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Passes all tests and QA script.

Tested with a public report:
select * from items
  - cgi-bin/koha/svc/report?id=6
  - URL shows JSON and all items
select * from items where itype = <<itype>>
  - cgi-bin/koha/svc/report?id=6&sql_params=BK
  - URL shows JSON and only BK items
select * from items where itype = <<itype>> and homebranch = <<homebranch>>
  - cgi-bin/koha/svc/report?id=6&sql_params=BK&sql_params=MPL
  - URL shows JSON and only BK items in MPL
select * from items where itype = <<itype|itemtypes>> and homebranch = <<homebranch|branches>>
  - same as above
  - URL shows JSON and only BK items in MPL
select * from items where dateaccessioned = 2013-12-15
  - cgi-bin/koha/svc/report?id=6&sql_params=BK&sql_params=MPL&sql_params=2013-12-15
  - URL shows JSON and correct items

Note: This will currently only work for public reports!

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Bug 9915: (follow-up) use SQL placeholders

This patch teaches C4::Reports::Guided::execute_query()
how to accept a list of query parameter values.  It then
follows-up on the main patch by simplifying how it converts
report parameters to a complete SQL query, and removes the
use of DBI->quote() and complicated regexes.

To test:

[1] Verify that using the OPAC svc/report service with
    sql_params continues to work.
[2] Verify that there are no regressions with running
    reports from the staff interface, both via the web
    service and the reports interface.
[3] Verify that prove -v /db_dependent/Reports_Guided.t passes.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Passes all tests and QA script.
No regressions found.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>