Bug 13425 - XSS in intranet facets - Patch for 3.18 and master

To Test
1/ Craft a url like /cgi-bin/koha/catalogue/search.pl?q=smith&sort_by='"><script>prompt('Happy_Holidays')</script>

It is important it must return results and facets

2/ Notice the js is executed
3/ Apply the patch test again

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
No prompts, no functional regressions found.
Checked selecting and undoing facets, show more links and paging.
Signed-off-by: Mason James <mtj@kohaaloha.com>

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 13017 - Login page image replacement technique fails when browser width exceeds 2000 pixels

This patch updates the image replacement technique used for Koha's login
page. The old technique used a negative text-indent value to move the
text offscreen, but that begins to fail more and more often as screens
get larger.

The new technqiue is described here:
http://www.zeldman.com/2012/03/01/replacing-the-9999px-hack-new-image-replacement/

Note: This patch has not been tested in any Internet Explorer version!

To test you must have a screen which is wider than 2000 pixels. Apply
the patch, clear your browser cache and view the staff client login
page. The logo on the login form should look correct with no
corresponding text appearing anywhere on the screen.

Signed-off-by: Christopher Brannon <cbrannon@debian.localdomain>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 1861 - Unique patrons logins not (totally) enforced

The Koha 3.0 patron admin page will prevent you from creating a user who
has an identical OPAC login as someone else (though I would change the
error message from "Login/password already exists." to "Login
already exists.", since it's not the password that's the
problem).

However, there's nothing enforced in the MySQL database to prevent
patrons from being imported or manually inserted with duplicate logins.
Would it be better to change the MySQL spec from this:
KEY `userid` (`userid`)
to this:
UNIQUE KEY `userid` (`userid`)

Test plan:
1) Enter mysql console
2) Attempt to create two borrowers with identical user id's
3) Note you are able to do so
4) Delete these bororwers
5) Apply this patch
6) Run updatedatabase.pl
7) Repeat step 2
8) Note you are now unable to do so

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Work as described, no koha-qa errors

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Leaves deletedborrowers as it is, deleting patrons still works ok.
Works according to test plan.
Database update will only be successful, when no duplicate entries
exist in the database.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 1861 [QA Followup] - Fix Check_Userid and unit tests

Check_Userid assumes that a borrowernumber will always be passed in
and thus fails to to return 0 for an already used userid when creating
a new patron.

Unit tests must now also me modified to no longer assume it is possible
to create multiple patrons with the same userid.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 1861 [QA Followup] - Don't modify userids, warn if we can't modify the index automatically

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Bug 13453: Koha.t daily quote tests assume sample data

By adding quotes 3 and 25 from the sample data, this test can
pass without having the sample quote data loaded.

TEST PLAN
---------
1) Ensure there is no quote id=3 or that it is NOT
   Abraham Lincoln.
2) prove t/db_dependent/Koha.t
   -- this should fail the daily quote test.
3) apply patch
4) prove t/db_dependent/Koha.t
   -- this should *NOT* fail the daily quote test.
5) run koha qa test tools

Followed test plan 1)-4). Without patch, daily quote test failed. With patch, test passed OK.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Works as described, leaves actual data unchanged.

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 1861: DBRev 3.19.00.003

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 13360: C4::Ris assumes that hash keys are ordered - KW

This patch only fixes the KW order.

Test plan:
1/ Choose/create a record with several 6XX (for KW), see the code source
to know which fields you can use
2/ Export this record in RIS format
3/ Verify that the KW lines are ordered following the marc record fields
order.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

We really should refactor this whole thing into Koha::RIS sometime, it's
a horrible module at the moment.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 13357: Untranslatable strings on itemsearch.tt

This patch enable translation of labels on itemsearch.tt

To test:
1) Translate for a fairly complete language (es-ES de-DE)
2) On staff, go to Search > Item search
3) Check there are many untranslated strings
e.g. Text before pulldowns on first and second box
     All options on third box

4) Apply the patch

5) Repeat 1 & 2
6) Check there are now some strings translated
7) Update translation file, check there are some
new strings to translate (may be they are fuzzy)
e.g. "All statuses", "All collection codes"

Patch works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 13124 - Record titles with parentheses causing label weirdness

Test Plan ( using sample data included with Koha )
1) Catalog a record and item with the title "Oh no! or, (How my
   science project destroyed the world) /"
2) Edit the DEFAULT template
   a) Set layout type to Biblio
   b) Set data fields to "title, author, isbn, issn, itemtype,
      barcode, itemcallnumber"
   c) Set font size to 10
3) Create a batch with just the one item you created
4) Export the PDF with the Avery template and the DEFAULT layout
5) Note the weirdness
6) Apply this patch
7) Re-export the PDF, note it's no longer weird ; )

Signed-off-by: Nick Clemens <nick@quecheelibrary.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 13285 Do the right thing if opacthemes is not set

If opacthemes is not defined updatedatabase reports the
subsequent warnings as an error. Take account of the case where
it is not set and default that to bootstrap.

This is probably a rare occurence, but should be handled

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 9958: Improve RoutingSerials sys pref description

The RoutingSerials preference controls if the routing
list related functionality is visible in the serials
module.

To test:
- Go to the system preference editor - RoutingSerials
- Check the current description
- Apply patch
- Check the new description
- Verify functionality matches description

NOTE: The preference change is merely cosmetic. The value is
      still YesNo. A few git reset --hard origin/master
      and page refreshes confirmed expected values.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 13458: Display the correct patron categories

Bug 9811 removes useful code.
Actually the AddPatronLists pref is not sent to the template from
members/member.pl.

To fix this issue, we can use the existing not clean way, or compare the
syspref value directly in the template. This second solution is
implemented in this patch.

Test plan:
1/ Set the AddPatronLists pref to 'specific'
2/ On the patron home page (members/members-home/pl), the patron search
result page (members/member.pl after launching a search) and on the
checkouts page/patron search result (circ/circulation.pl after searching
a patron using the check out), verify that the patron category list is
the specific ones.
3/ Test there are no regression with the AddPatronLists pref set to
'general'.

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Works as described and fixes the problem.

Note: I am not sure if AddPatronLists makes sense -
if you set it to general patron types, it still preselects the
wrong category type (tried organization, a child patron category
was selected). Also the name is confusiong nowadays with the
Patron list feature.

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 12895 repair dropbox mode

One day late patrons were restricted even with dropbox mode activated

1) Check in the calendar (Tools/Calendar), that the
   previous days you are about to use as date due are
   really entered as opening day (never know).
2) Add a suspension in the suspension days parameter
   of the circulation rules (Administration/Circulation
   and fine rules) to the MOST specific category of
   borrower and MOST specific type of document among the
   existing rules of the LOGGED IN Site(cf explications
   in the circ-rules page).
3) Choose a borrower using the search by category and an
   item through the advanced search using the limit by type.
4) Checkout the item selecting the previous opening date
   in the Specify-due-date box.
5) Click on Circulation in the upper menu, then on Checkin
   and check the Book drop mode. The Book drop date showed
   should be the previous opening date.
6) Check in the item : you can see that the patron is restricted
7) apply the patch
8) Redo 1 to 5 : Now, you can see that the patron is not restricted.
9) If you redo the test with two day late, you will see that
   the patron is not restricted : that's ok because his
   restriction of one day is already finished.
10) If you redo the test with more than two day late, you see
    that the patron restriction is, as expected, one day shorter
    than it were if the item had been returned without dropbox mode.

Signed-off-by: Nick Clemens <nick@quecheelibrary.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 13447: Fixed HTML Email Reports

A tiny typo made in runreport.pl when updating it for bug 9530 lead to
no body being attached to html emails.

Signed-off-by: Chris <chris@bigballofwax.co.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 13341 - Hard-coded "Preview" text in OPAC openlibrary.js

The OpenLibrary JavaScript includes an untranslated string, "Preview."
This patch move the string to the template so that it can be translated.

To test, apply the patch and test that the translator picks up the
string:

1. From misc/translator run 'perl translate update [lang]' (e.g. de-DE)
2. Edit misc/translator/po/[lang]-opac-bootstrap.po and add a
   translation for the updated "Preview" string
3. Remove the "#, fuzzy" marker from that entry
4. From misc/translator run 'perl translate install [lang]'
5. Enable the [lang] translation for the OPAC in system preferences
6. Enable the OpenLibraryCovers system preference.
7. In the OPAC switch to the [lang] translation.
7. View the detail page for a title for which there is an OpenLibrary
   cover image. Below it you should see a preview link with the
   translated string you added in step 2.

Works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 13252 - SIP2 server should accept IPv6 connections

This small patch adds a check on the SIP2 socket connection if it is
IPv6 and resolves socket address accordingly.

Any newer Debian distro would probably default to IPv6 so it would
eventually affect all SIP servers.

Tests against running SIP server on an IPv6 box:

http://wiki.koha-community.org/wiki/Koha_SIP2_server_setup#Testing_with_Telnet

before patch:
  disconnects immediately. Log output:
  Bad arg length for Socket::unpack_sockaddr_in, length is 28, should be 16

after patch:
  operates normally

Signed-off-by: Colin Campbell <colin.campbell@ptfs-europe.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 13252 Allow for IPv6 formatted addresses in Port definition

The SIP config has allowed you to specify an interface ip as
part of the listeners/service/port attributei
 e. g.  as port="127.0.0.1:6001/tcp"
with IPv6 the equivalent would normally be
   as port="[::1]:5001/tcp"
However in this case incoming connections will get rejected because
Configuration constructs a string without the brackets
This patch makes tests both formats on incoming connections so that
they are accepted as they were previously

In future the best course is not to include a port identifier in the
port definition then if the server has ipv6 it will bind to all
interfaces and accept both IPv4 and IPv6 traffic

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>