Bug 11660: remove disused tools/pdfViewer.pl

tools/pdfViewer.pl can be used to read artibrary files on the system.

It is actually an unused file, so leaving it around serves no purpose
and is dangerous.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
No regressions found.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit d1b6e0646fd6a70f6724189554e80aaa68aec64b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Bug 11661: sanitize file names supplied to edithelp.pl

This patch corrects an issue whereby edithelp.pl could
be used to create or modify arbitrary files on the server
with the permissions of the Apache user.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 7baf02c263a627b1454577b3141a0af4b8f963d1)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Bug 11662: remove disused member-picupload.pl

This script is no longer used, and in addition has problematic
handling of its parameters that could lead to writing to
arbitrary files on the server.

To test:

[1] Verify that member-picupload.pl is no longer referred
    to in the codebase after applying this patch.
[2] Verify that there are no regressions in patron
    photo management.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Found no regressions in removing this script.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 939079de756fdda1ca8f62c48efe0e2e3034ae32)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Bug 11666: add permission check for MARC framework import/export

This patch makes the MARC framework import/export script require
that the staff user be logged in with appropriate permissions for
managing the MARC frameworks.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

I can confirm the bug and the solution. After applying the patch
downloading the file without logging in first is no longer possible.
Also passes tests and QA script.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 03d4ed2468bb9ab97b1f7b7d9e29507dc815a8b3)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Bug 11666: remove SQL as an option for MARC framework exports and imports

The SQL option for MARC framework imports was subject to a bug whereby
somebody could use it to gain access to arbitrary information in the
database by uploading an SQL file containing unexpected statements.

As it is difficult to securely sanitize SQL, this patch removes the
option to use SQL as an import or export format.

To test:

[1] Verify that SQL no longer appears as an import or export option
    for the MARC frameworks.
[2] Verify that exports and imports in CSV, Excel XML, and ODS formats
    still work.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Works as advertised. The UI doesn't offer exporting/importing in the SQL format.
Crafting the URL to export SQL fallbacks to a spreadsheet format (ODS).

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Works as described, passes all tests and QA script.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 94e349ff6ce4a1abb313102decc12429d02dfb4b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Update release notes for 3.14.03 release

Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Increment version for 3.14.3 release

Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Bug 9579: fix truncation of facets containing multi-byte characters

We seem to be relying on whatever Zoom::Results->render return, and
Perl doesn't explicitly consider it UNICODE data. That's why CORE::substr
(and probably CORE::length too) cut the bytes wrong.

This patch just decodes the UTF-8 data that render() returns and then
Perl behaves, heh.

It uses Encode::decode_utf8 which is already a dependency for the current
stable Koha releases.

REVISED TEST PLAN
-----------------
1) Import the attached sample records.
2) Rebuild your indexes
3) In OPAC search for يكيمكتبات : قبسي ، كرم
-- There will be ugly diamonds with question marks in the facets
4) apply the patch
5) Search again.
-- The names will be properly truncated.
NOTE: This test assumes FacetLabelTruncationLength = 20.

Sponsored-by: Universidad Nacional de Cordoba

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Passes all tests and QA script.
Works as described, tested with several German, English and
the Arabic test record. Arabic strings now display correctly
and no regression was found.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>

I've reviewed it and approve its inclusion in 3.14.x and earlier.  I
will use the patches for bug 11096, once they pass QA, for the master
branch.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Bug 11439: (follow-up) adjust for change in list returned by OCLC XISBN

The set of related ISBNs for the first Harry Potter book returned
by OCLC's XISBN service has changed recently, so this patch adjusts
the test to match.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 6e21422d00f02c88384ce361dab86ccc44e92e49)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Bug 11384: (follow-up) test if table exists in update database

Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Bug 11509: improve usage information printed by koha-create

This patch makes koha-create print better and more descriptive usage
information. Also adds the --help and -h switches.

Sponsored-by: Universidad Nacional de Cordoba
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Removed trailing " from:
  $scriptname [db usage mode] [options] instancename"

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 0d28ab498885a44ee2c20c411ae16b904c12663a)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Bug 11509: (follow-up) fix a couple typos

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit b7b1db5c81eb67e51851efc5bc2d1fb2a0cb7d04)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Bug 11510: koha-translate usage message fixes

The koha-translate's usage message has a couple of inconsistencies:

'--all' should be '--available'
and '--help' is missing from the usage examples.

Sponsored-by: Universidad Nacional de Cordoba
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Works as described, tested using instructions on
http://wiki.koha-community.org/wiki/Testing_man_pages

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 83ab4edc5a79c6e2ca0f4d394387d20c9aee7453)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Bug 10896: Add a --verbose option to koha-translate

The -v and --verbose option switches add the --verbose switch to the
misc/translator/translate script call in the packages' 'koha-translate'
command.

The docs are updated accordingly.

Sponsored-by: Universidad Nacional de Cordoba
Signed-off-by: Magnus Enger <magnus@enger.priv.no>
Works as expected with and without -v. Man page looks good.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit cfc3ce6772b908bb73a38a3bb778b8f25bb4ac9e)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Bug 11208: regression test for failing SMS messages

This patch adds a regression test for verifying that queued
SMS messages meant for patrons who have no SMS alert number
set are marked as failed after the first attempt to send them.

To test:

[1] Run prove -v t/db_dependent/Letters.t.  The fourth
    test should.
[2] Apply the main patch and run t/db_dependent/Letters.t
    again.  This time, all tests should pass.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit b753678c3dff4e0fd2fde008b3c43f0796fcfb05)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Bug 11208: If no smsalertnumber is defined, the message is marked as failed

For DUE message (and PREDUE, etc.) there are no check before sending the
message to the message_queue table.

This check avoids to try to send again and again the same message. Now
it is marked as "failed".

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Without the patch a sms notice will remain as 'pending' forever.
With the patch applied, the status is set to 'failed'.

Passes all tests and QA script.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 87564a834b885188ee0e6fde800775b403d2e1c0)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Revert "Bug 11208: If no smsalertnumber is defined, the message is marked as failed"

This reverts commit 932ad64f3503d43f696d0b3e534aaf3a48082b5a.

Bug 11208 depends on Bug 9016 which is for 3.16
Revert "Bug 11208: regression test for failing SMS messages"

This reverts commit c4f6a2777d7f068d3c072352832c48461689431c.

Bug 11208 depends on Bug 9016 which is for 3.16
Bug 11192: Fix lf and ff07-02 definition in ccl.properties

ff7-02 1=87020 (position 2 of field 007 in MARC21) should be
ff7-02 1=8702

lf 1=8833
lf fiction
fic fiction

should be

lf 1=8833
fiction lf
fic lf

To test :
1. apply the patch
2. copy the modified ccl.properties into your active Zebra config
   directory
3. reindex zebra (rebuild_zebra.pl -b -x -r -v)
4. make some searches using the fixed indexes

Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit a032b0a5cd73c9a67bab130c183751309fa95c6e)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Bug 11192: (follow-up) fix a little typo

Test plan the same as the original patch

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Tested according to test plan. Searches tested were:
fic=e
fiction=e

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 211acdd30b000af33f1bb70b33356b8ac945f451)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>