Bug 13425 - XSS in opac facets - Patch for master and 3.18

To Test
1/ Craft a url like /cgi-bin/koha/opac-search.pl?q=123&sort_by='"><script>prompt('Happy_Holidays')</script>&limit=123

It is important it must return results and facets

2/ Notice the js is executed
3/ Apply the patch test again

Signed-off-by: Mirko Tietgen <mirko@abunchofthings.net>
Popup is gone after applying the patch. Facet link still shows it but does not execute. It's gone after clicking the link.

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 13428: Fix regression on deleting facets

Test plan:
Search for something
click on a facet with diacritic
click on another facet
remove the facet with diacritic

Signed-off-by: Mason James <mtj@kohaaloha.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 13398: rotating collections scripts are skipped on install

This patch makes the Makefile.PL script pick the rotating_collections/
directory for install.

To test:
- Run:
  $ perl Makefile.PL
- Install using either 'standard' or 'single' method.
=> FAIL: Verify that there is no 'rotating_collections' directory
   on the intranet CGI direcory.
- Apply the patch
- Run:
    $ perl Makefile.PL
- Install using either 'standard' or 'single' method.
=> SUCCESS: Verify that there is a 'rotating_collections' directory
   on the intranet CGI direcory.
- Sign off :-D

Regards
Tomas

PS1: Note that it should be enough to check for the rotating_collections files
     on the generated Makefile after 'perl Makefile.PL'.
PS2: The packages use the 'standard' install method to generate the file tree.
     So this patch should fix the packages too.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 13451: Holidays.t assumes default data

This patch removes that assumption by expressly setting data
to be default.

TEST PLAN
---------
1) Ensure that branch code is NOT 'MPL' in the
   repeatable_holidays table in your database.
2) Ensure that branch codes 'MPL' and 'CPL' do not exist
   in the branches table in your database.
3) prove t/db_dependent/Holidays.t
   -- this should bomb horribly.
4) Apply patch
5) prove t/db_dependent/Holidays.t
   -- all tests should succeed.
6) run koha qa tests

Signed-off-by: Nick Clemens <nick@quecheelibrary.org>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Tests pass without holidays in the calendar.

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
BUG 13468: Overdue notice lists all checked out books

This patch should fix the issue when running under 'triggered' mode

To test:

1) Run overdue_notices.pl -t -n [to output notices to command
line]
2) Note that the notices output, list ALL checked out items
3) Apply Patch
4) Run again
5) Note the difference

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Amended patch: remove space changes.

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 13375: Syspref search highlight styling broken in Chrome

This patch encloses the the syspref description/values mix in a <div>.
It doesn't introduce any regression on other browsers (like Firefox) and
has the side effect to make Chrome render the highlighted words on
syspref searches well.

This alternate patch uses a <div> instead of a <span> because it will
sometimes contain block-level elements. Follow the same plan:

To test:
- Search for 'facet' on the sysprefs
=> FAIL: verify it has styling problems in Chrome
- Apply the patch, reload
=> SUCCESS: styling is correct

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 13362: translate script creates dirs on update

A dir creation was uncommented (by me), the effect is
create a lang dir on 'update', which is no needed.

To test:
1) Update translation files for a uninstalled language
(cd misc/translator; ./translate update xx-YY)

2) Check new dirs
koha-tmpl/opac-tmpl/bootstrap/xx-YY/
koha-tmpl/intranet-tmpl/prog/xx-YY/
koha-tmpl/intranet-tmpl/prog/en/modules/help/xx-YY/

3) Clean all
git clean -f -d

4) Apply the patch

5) Repeat 1) (i.e. update)

6) Check no new dirs this time

Signed-off-by: Frederic Demians <f.demians@tamil.fr>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Tested according to test plan, works as described.
Passes tests and QA script.

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 11706: Typo fix for "efault" in old database update

To test:
- Verify the typo has been correct and no other changes
  have been made

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Typo fixed, no koha-qa errors.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 10051: Separate first name and surname with comma in overdues report

The name of the patron who has overdues is displayed as
"surname first name" instead of "surname, first name".

To test:
- Go to circulation > overdues
- Verify that first name and surname are not separated by comma
- Apply patch
- Verify the display is improved with a comma
- Delete the first name from one of the patrons
- Verify display is still ok

Signed-off-by: David Roberts <david.roberts@ptfs-europe.com>
Signed-off-by: Christopher Brannon <cbrannon@debian.localdomain>

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 13355: System preferences tab value wrong in templates

This patch fixes a bug on the system preferences tab templates.

To test:
To reproduce:
(1)
- Choose a tab on the sysprefs section (for example 'Enhanced Content')
- Right click on 'Enhanced Content preferences' title, and choose to 'inspect' the code
=> FAIL: you will see below the form tag something like:
<input type="hidden" name="op" value="save">
<input type="hidden" name="tab" value="">

(2)
- Do a syspref search (for example 'facet').
- Right click on one of the category titles (for example 'OPAC preferences')
=> FAIL: you will see below the form tag something like:
<input type="hidden" name="op" value="save">
<input type="hidden" name="tab" value="HASH(0x6e53050)">

- Apply the patch
- Repeat (1) and (2)
=> SUCCESS: you will see below the form tag something like:

<input type="hidden" name="tab" value="enhanced_content">
and
<input type="hidden" name="tab" value="opac">

respectively.
- Sign off :-D

Regards

Signed-off-by: wajasu <matted@34813.mypacks.net>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
fix for 13331 [Bug 13331] Subfield does not show in cataloging editor - if subfield is disabled in OPAC/enabled in Staff, via frameworks

to test...

1/ attempt to add a new bib in the cataloguing editor, default framewok
  - observe 245b subfield is visible in the editor, for tab 2

2/ uncheck the OPAC visibility for 245b, within the framework editor - then save

3/ repeat step 1/
  - observe that the 245b subfield has disappeared from the cataloguing editor!

4/ apply patch,

5/ repeat step 1/
  - observe that the 245b subfield now displays correctly in the cataloguing editor

note: this looks looks like a typo bug, that has been in koha for years

Signed-off-by: wajasu <matted@34813.mypacks.net>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 13410 - Untranslatable "Change messaging preferences to default for this category?"

To test:
In staff client, go to Home > Patrons
Click button "New patron" and choose a category
Change Patron messaging preferences
Now change Category
Make sure that following message box still appears: "Change messaging
preferences to default for this category?"

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 13410 [QA Followup]

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 13368 Holds priority messed up on checkout

To Test

1/ Create 3 (or more holds) on one biblionumber, make sure at least
one item is not on loan
2/ Check out the not on loan item to a borrower (maybe number 2 in the
queue)
3/ Look in the database (or on the holds tab on the moredetail.pl)
notice the priorities have not been reordered
4/ Apply patch and try again, notice now they have

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Confirmed the problem without the patch, and confirmed that the patch
corrects it.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
bug 13460: suggestion.tt now uses Price plugin

To test:

1/ Add a new suggestion, put some values for the price
2/ View the suggestion in the staff interface
2/ Switch the currency format
3/ Notice the format of the price does not change
4/ Apply patch
5/ Notice now the syspref is respected

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Works as described, thx!

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 12059: Publisher column on invoice page always empty

This patch moves the publisher information out of its own
always empty column into the Summary column below the title,
as it is on other acq pages.

The information was never displaying, as publishercode is in
biblioitems and that table was not selected by GetInvoiceDetails.

Also modified the code to take into account that UNIMARC uses
biblioitems.publicationyear and MARC21/NORMARC use bibio.copyrightdate
for the copyright year.

To test:
- create an invoice for records that
  - have a publication year
  - have no publication year
  - have a publisher...
- 'finish receiving' and check the invoice summary page
   ...acqui/invoice.pl?invoiceid=?
- Make sure all the information displays now but didn't witout the patch.

Signed-off-by: Paola Rossi <paola.rossi@cineca.it>

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 12059: Prefer to list fields in the query

To avoir further issue, it's better to explicitely list the fields we
want to retrieve.

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 12084: Format planned date in publication details on detail page

If items are created for a serial subscription, the issue
information is shown on the details page in staff with the
planned date in ().

To test:
1) Create a subscription with items added on receive
2) Receive a few issues and create items
3) Check the staff detail page
4) Verify that the published date shows under Publication details
   in the items table, but that the date is not formatted
5) Apply patch
6) Verify the date is now formatted according to the DateFormat
   system preference setting

Signed-off-by: Paola Rossi <paola.rossi@cineca.it>

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 13400: Untranslatable "Are you sure you want to delete this authority?"

This patch makes the string "Are you sure you want to delete this
authority?" translatable using the function _(...)

To test, apply patch and check that deleting authorities still works.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Tested successfully with the following procedure:

1. Applied the patch.
2. Ran perl translate update de-DE
3. Edited de-DE-i-staff-t-prog-v-3006000.po to add a "translation"
4. Removed "#, fuzzy" marker from po entry.
5. perl translate -v install de-DE
6. Testing deleting an authority from the authority search results page
   and from the detail page. My translated string appeared correctly.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 13400 [QA Followup] - Fix tabs and quotes

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>