Bug 11535: sanitize input from patron self-registration form

This patch adds the use of C4::Scrubber to the processing of input
from the patron self-registration form, thereby closing off one
avenue for Javascript injection.

To test:

[1] Use the OPAC self-registration form to enter a new patron,
    and set its address to something like:

    <span style="color: red;">BAD</span>

[2] In the staff interface, bring up the new patron record.  The
    address will show up in red, indicating a successful HTML
    injection.
[3] Apply the patch and use self-registration to enter a new
    patron with a similar case of unwanted HTML coding.
[4] Bring up the second patron in the staff interface.  This time,
    the undesirable HTML tag should not be present.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Liz Rea <liz@catalyst.net.nz>
Tags are not present on testing.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Confirmed bug and that the patch fixes it.
Passes all tests and QA script.

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 11174: fix OPAC search links built from authority 5xx fields

In the templates opac-authoritiessearchresultlist of prog and
bootstrap the incorrect parameter 'valuec' is changed to 'value'

To test:

1) Insert an authority record with a 5xx field  (on MARC21 or UNIMARC)
2) Index the record
3) Search for the record in using OPAC authorities search.
4) Click one of the "see also" links built from the 5xx field, the link
   doesn't work
5) Apply the patch
6) Close the browser
7) Open the opac and select the english interface
8) Redo the search
9) Now the link works
10) To use the patch in others languages you need to regenerate the
    templates.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Tested with bootstrap.

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Following commit remove the use to valuec:
 commit 31f41e2c1db9d8dca82e0249050acb8f906c8164
    Bug 8206: Specify index in OPAC authority search

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 09fcd6980301bae3daad68f8cc27a2d5e7d488e4)
Signed-off-by: Fridolin SOMERS <fridolin.somers@biblibre.com>
(cherry picked from commit 27596b0c6a808fda6a08abb4cd46a98025e3a38f)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Removed the Bootstrap bits.
Bug 9224: Make acqui/finishreceive.pl Plack-compatible

Under Plack/mod_perl wrapping, sub update_item() will become a closure,
so after the 1st run it will retain its own private instances of the
following variables: $booksellerid, $datereceived, $unitprice, $rrp,
$biblionumber.

I.e., in case update_item() gets invoked 2nd+ time (inside
the same process, but for different-subsequent receives) it may
incorrectly flag the (old, wrong) biblionumber for Zebra reindexing,
and erronously modify the current item[s] with the previously
used (wrong) values.

This simple patch should make acqui/finishreceive.pl Plack-compatible.

Test plan:
Test patched acqui/finishreceive.pl script (create and receive some
orders w/ items, etc.). Ensure items are gettting added and/or modified
correctly during receiving process.

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Passes koha-qa.pl, works as advertised, no regressions found.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 6dcc34c1b44f72a8602c4ee95540836e6cd1e7bd)
Signed-off-by: Fridolin SOMERS <fridolin.somers@biblibre.com>
(cherry picked from commit 2a38ac7259bbe88d1d531bfd9d93d9edee64a4c4)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 11255: allow "relevance ascending" as a sort option

This patch fixes a problem where if a staff member sets the
*defaultSortField/*defaultSortOrder system preferences to relevance
ascending while QueryParser is enabled, default keyword search
would break -- the query parser config did not declare relevance asc
as a possible "modifier".

Note that setting the sort order to relevance ascending does not
actually make catalog search return results with the least relevant
records showing up first; Zebra does not support such a mode.  In other
words, relevance ascending acts exactly the same as relevance descending.

Test plan:

0/ Create some biblio with "history" in the title and
   ensure that the QueryParser system preference is enabled.
1/ Define prefs defaultSortField = relevance and defaultSortOrder = asc
2/ Search "history" on the staff interface
3/ Note that no result is returned.
4/ Apply the patch
5/ Verify the queryparser config file in use takes the modification into
account (see the queryparser_config value in your $KOHA_CONF file).
6/ Relaunch the search and verify results are returned

Signed-off-by: Christopher Brannon <cbrannon@cdalibrary.org>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 54937c5eb34c511e00de8d0831141516422885c7)
Signed-off-by: Fridolin SOMERS <fridolin.somers@biblibre.com>
(cherry picked from commit 96599cc238393ff3f70445c512ff8ffc87bc13ce)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Works as described. Had to copy the queryparser.yaml file to my koha-dev/etc/searchengine dir.
Bug 11166: make library filter in funds administration page more precise

In funds administration, admin/aqbudgets.pl, there is a combobox for
filtering by library code.

The bug is that the filter uses a pattern match  instead of equals :
  next unless $budget->{budget_branchcode} =~ m/$filter_budgetbranch/;

In this case, if there is a library with code '1' and one with code '12',
filtering by library '1' will also show funds of library '12'.

Test plan :
- Create a library with code '1' and one with code '12'
- Create funds in both libraries
- Go to admin/aqbudgets.pl
- Filter by branch '12'
=> You see only funds of this library
- Filter by branch '1'
=> You see only funds of this library

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Passes koha-qa.pl, works as advertised

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 484d1490925d736f99a430a6933c96e42ea4e768)
Signed-off-by: Fridolin SOMERS <fridolin.somers@biblibre.com>
(cherry picked from commit 64c79561bbabf6476fb72c27435789f4dd19180a)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 11410: ensure cataloging search finds results for searches with ampersands

When QueryParser is off, the cataloging search is passing the incorrect
variable to SimpleSearch.  I'm sure this is causing other issues, but
the one I have identified is that any searches with an "&" in them
return no results.  This patch corrects the bug.

Test Plan:
1) Catalog a new record titled "Cats & Dogs"
2) Rebuild your zebra index so this record is indexed
3) Browse to cataloguing/addbooks.pl
4) Search for "Cats & Dogs"
5) Notice you get no results
6) Apply this patch
7) Repeat the search
8) Notice your result now shows up!

Signed-off-by: Heather Braum <hbraum@nekls.org>
Signed-off-by: Suzanne Fayle <sfayle@roseman.edu>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
This works as described, passes all tests and QA script.
Note: Because $query = $builtquery when the QueryParser is used,
this problem is only visible when UseQueryParser is set to "Don't try".

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 2a4e193c242372f488892591a72752dfd4ffb138)
Signed-off-by: Fridolin SOMERS <fridolin.somers@biblibre.com>
(cherry picked from commit 0c500f463001db06c8c1f72f8b81c8edde6487d7)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Bug 10735: prevent koha-dump from aborting if backupdir undefined

Older versions of Koha didn't have <backupdir>...</backupdir> defined in
koha-conf.xml. The koha-dump script is aware of this, and checks to see
if it's there. However, if it's not, xmlstarlet returns a non-0 error
code which causes the script to abort due to running under set -e.

Test plan:
 * Remove backupdir from koha-conf.xml
 * Run koha-dump, notice that it doesn't do backups
 * Apply patch
 * Run koha-dump again, notice that it does do backups

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
The fallback method works as described. It might be made more robust
like checking for dir existence (thinking of older instances upgrades).
But it certainly belongs to another bug report.

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
As Tomas said, it would be better to alert the user if the backupdir tag
does not exist (or contains a nonexistent directory) in the config file.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
(cherry picked from commit 266f2a3a9f3d67fed0e0b35d267419a901345b92)
Signed-off-by: Fridolin SOMERS <fridolin.somers@biblibre.com>
(cherry picked from commit de1344c2759631e1a8d505151630f160ebdab768)
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>