February 2017 - Koha-bugs - lists.koha-community.org

[Bug 14365] SQL Reports Last Edit Date column
by bugzilla-daemon＠bugs.koha-community.org 07 Feb '17

07 Feb '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14365 --- Comment #2 from Kyle M Hall <kyle(a)bywatersolutions.com> --- Created attachment 59986 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=59986&action=ed… Bug 14365 - SQL Reports Last Edit Date column - Show in interface -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14365] SQL Reports Last Edit Date column
by bugzilla-daemon＠bugs.koha-community.org 07 Feb '17

07 Feb '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14365 --- Comment #1 from Kyle M Hall <kyle(a)bywatersolutions.com> --- Created attachment 59985 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=59985&action=ed… Bug 14365 - Populate never used saved_sql column last_run when execute_query is called -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14365] SQL Reports Last Edit Date column
by bugzilla-daemon＠bugs.koha-community.org 07 Feb '17

07 Feb '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14365 Kyle M Hall <kyle(a)bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 13618] Prevent XSS in the Staff Client and the OPAC
by bugzilla-daemon＠bugs.koha-community.org 07 Feb '17

07 Feb '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13618 --- Comment #214 from Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> --- Created attachment 59984 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=59984&action=ed… Bug 13618: Use a simplified version of Template::Stash::AutoEscaping Koha::Template::Escape is a simple version of Template::Stash::AutoEscaping It seems that removing and cleanly some pieces of Template::Stash::AutoEscaping will bring us a lot of performance boost. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 13618] Prevent XSS in the Staff Client and the OPAC
by bugzilla-daemon＠bugs.koha-community.org 07 Feb '17

07 Feb '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13618 Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #47425|0 |1 is obsolete| | Attachment #47426|0 |1 is obsolete| | Attachment #47427|0 |1 is obsolete| | Attachment #47428|0 |1 is obsolete| | Attachment #47429|0 |1 is obsolete| | Attachment #47430|0 |1 is obsolete| | Attachment #47431|0 |1 is obsolete| | Attachment #47432|0 |1 is obsolete| | Attachment #47433|0 |1 is obsolete| | Attachment #47434|0 |1 is obsolete| | Attachment #47435|0 |1 is obsolete| | Attachment #47436|0 |1 is obsolete| | Attachment #47437|0 |1 is obsolete| | Attachment #47438|0 |1 is obsolete| | Attachment #47439|0 |1 is obsolete| | Attachment #47440|0 |1 is obsolete| | Attachment #47441|0 |1 is obsolete| | Attachment #47442|0 |1 is obsolete| | Attachment #47443|0 |1 is obsolete| | Attachment #47444|0 |1 is obsolete| | Attachment #47445|0 |1 is obsolete| | Attachment #47446|0 |1 is obsolete| | Attachment #47447|0 |1 is obsolete| | Attachment #47448|0 |1 is obsolete| | Attachment #47449|0 |1 is obsolete| | Attachment #47450|0 |1 is obsolete| | Attachment #47451|0 |1 is obsolete| | Attachment #47452|0 |1 is obsolete| | --- Comment #213 from Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> --- Created attachment 59983 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=59983&action=ed… Bug 13618: Use Template::Stash::AutoEscaping to use the html filter Test plan: 0/ sudo cpanm Template::Stash::AutoEscaping 1/ Verify don't reproduce the XSS issue described on bug 13609 and other xss related bugs. 2/ Try to find some encoding issues (detail page, search results, facets, etc.) Signed-off-by: Signed-off-by: Joonas Kylmälä <j.kylmala(a)gmail.com> Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel(a)gmail.com> Bug 13618: Remove html filters at the OPAC This patch removes the html filters at the OPAC, if necessary. Generated with: perl -p -i -e 's/\ ?\|\ ?html(\ ?)%/\1%/g' **/*.tt **/*.inc Signed-off-by: Signed-off-by: Joonas Kylmälä <j.kylmala(a)gmail.com> Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel(a)gmail.com> Bug 13618: Specific places where we don't need to escape variables There is no need to escape the html generated by the XSLT. Signed-off-by: Signed-off-by: Joonas Kylmälä <j.kylmala(a)gmail.com> Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel(a)gmail.com> Bug 13618: Remove html filters at the intranet Signed-off-by: Signed-off-by: Joonas Kylmälä <j.kylmala(a)gmail.com> Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel(a)gmail.com> Bug 13618: Specific places where we don't need to escape variables - intra Signed-off-by: Signed-off-by: Joonas Kylmälä <j.kylmala(a)gmail.com> Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel(a)gmail.com> Bug 13618: Specific for pagination_bar Signed-off-by: Signed-off-by: Joonas Kylmälä <j.kylmala(a)gmail.com> Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel(a)gmail.com> Bug 13618: Specific for the ISBD view Signed-off-by: Signed-off-by: Joonas Kylmälä <j.kylmala(a)gmail.com> Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel(a)gmail.com> Bug 13618: Fix error 'Not a GLOB reference' The interpolation of a variable on including a file caused an unexpected error: Template process failed: undef error - Not a GLOB reference at /usr/lib/i386-linux-gnu/perl5/5.20/Template/Provider.pm line 619. The easier fix is to replace it with a SWITCH. Signed-off-by: Signed-off-by: Joonas Kylmälä <j.kylmala(a)gmail.com> Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel(a)gmail.com> Bug 13618: Specific for IntranetUser* and OPACUser* prefs Signed-off-by: Signed-off-by: Joonas Kylmälä <j.kylmala(a)gmail.com> Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel(a)gmail.com> Bug 13618: Specific for ColumnsSettings Signed-off-by: Signed-off-by: Joonas Kylmälä <j.kylmala(a)gmail.com> Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel(a)gmail.com> Bug 13618 - memberentrygen.tt errors Not a GLOB reference Like Jonathan said: The interpolation of a variable on including a file caused an unexpected error: Template process failed: undef error - Not a GLOB reference at /usr/lib/i386-linux-gnu/perl5/5.20/Template/Provider.pm line 619. Replaced it with a SWITCH, like the other patch for this similar error. Signed-off-by: Signed-off-by: Joonas Kylmälä <j.kylmala(a)gmail.com> Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel(a)gmail.com> Bug 13618: Specific for other prefs opacmainuserblock opacnav opacnavright opaccredits opacheader opaccustomsearch opacmysummaryhtml opacmysummarynote opacnavbottom opacnoresultsfound opacresultssidebar opacsearchfortitlein restrictedpagecontent PatronSelfRegistrationAdditionalInstructions intranetmainuserblock intranetnav intranetslipprinterjs OpacSuppressionMessage SCOUserCSS SCOUserJS SelfCheckHelpMessage NoLoginInstructions Signed-off-by: Signed-off-by: Joonas Kylmälä <j.kylmala(a)gmail.com> Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel(a)gmail.com> Bug 13618: Specific for Salutation on editing a patron Signed-off-by: Signed-off-by: Joonas Kylmälä <j.kylmala(a)gmail.com> Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel(a)gmail.com> Bug 13618: Specific for XSLTBloc Signed-off-by: Signed-off-by: Joonas Kylmälä <j.kylmala(a)gmail.com> Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel(a)gmail.com> Bug 13618: Fix escape on sending baskets or shelves by email Test plan: Send baskets and shelves by email. With or without this patch, you should not see any changes. Signed-off-by: Signed-off-by: Joonas Kylmälä <j.kylmala(a)gmail.com> Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel(a)gmail.com> Bug 13618: Fix for news Signed-off-by: Signed-off-by: Joonas Kylmälä <j.kylmala(a)gmail.com> Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel(a)gmail.com> Bug 13618: Fix last occurrences recently introduced to master Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel(a)gmail.com> Bug 13618: followup to remove tabs Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel(a)gmail.com> This followup on top of remote branch Only remove tabs and trailing spaces to make koha-qa pass Bug 13618: Fix for edit biblios and items On editing biblios or items, the marc_lib, marc_value and javascript values are often populated with html code which needs to be displayed raw. Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel(a)gmail.com> Bug 13618: (follow-up) Specific for ColumnsSettings Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel(a)gmail.com> Bug 13618: (follow-up) add missing lines for opac-shelves Proposed patch to fix opac-shelves Signed-off-by: Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> Bug 13618: Remove html filters for newly pushed code Bug 13618: Fix for system preference description If a syspref description contains html tag, do not display them Bug 13618: Do not display   and html tags in item fields content Note that there might be other occurrences to fix! Bug 13618: Do not display html tags in patron's notices Bug 13618: Fix for debarredcomment and patron messages At the OPAC and intranet. Bug 13618: (follow-up) Specific for other prefs follow-up for SlipCSS and printslip -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 13618] Prevent XSS in the Staff Client and the OPAC
by bugzilla-daemon＠bugs.koha-community.org 07 Feb '17

07 Feb '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13618 Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|BLOCKED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 15503] Grab Item Information from Order Files
by bugzilla-daemon＠bugs.koha-community.org 07 Feb '17

07 Feb '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15503 --- Comment #69 from Kyle M Hall <kyle(a)bywatersolutions.com> --- (In reply to Benjamin Daeuber from comment #68) > 2. The source of acquisitions is blank. I'm fairly sure that was populating > before the latest patch. I've been looking at the code and master and cannot find any indication that Koha does this. I also tried it out ( in case I missed the relevant code ) and the source of acquisitions was not auto-populated. In any case, if this is a regression, it wasn't caused by this patch and we should file a separate bug report for it. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 13618] Prevent XSS in the Staff Client and the OPAC
by bugzilla-daemon＠bugs.koha-community.org 07 Feb '17

07 Feb '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13618 Martin Renvoize <martin.renvoize(a)ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |martin.renvoize@ptfs-europe | |.com --- Comment #212 from Martin Renvoize <martin.renvoize(a)ptfs-europe.com> --- The approach here is correct in my opinion.. we should treat everything as unsafe and thus escape it by default unless we've manually checked it and marked as safe. Yes, this will impact performance at first and highlight some especially nasty areas of koha. We should use those highlights as a hitlist of areas to concentrate on a) checking security and marking as safe when possible and b) refactoring templates to more sparsely use variables when possible. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 12306] notes or statistics of transactions in Circulation
by bugzilla-daemon＠bugs.koha-community.org 07 Feb '17

07 Feb '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12306 --- Comment #2 from Eugene Espinoza <eugenegf(a)yahoo.com> --- (In reply to Eugene Espinoza from comment #0) And > also, in one of the Koha projects I am currently involved with, they wanted > to know if a certain material borrowed for photocopying can be tag such, so > this feature on notes/tags on circulation transactions came up again in my > mind. This one was already addressed by Koha ILS feature of on-site check-out However the note/s on a particular transaction still stand in this bug/feature enhancement request. Say, from a migrated circulation, there are circulation records that the librarian just received the csv file of circulation records and notes are written on the transactions to indicate say that the date can not be ascertained, who was the one responsible for lending the material and other notations that relates any claim from the borrower and the librarian. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 15408] Timestamp not updated when you duplicate a budget
by bugzilla-daemon＠bugs.koha-community.org 07 Feb '17

07 Feb '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15408 --- Comment #4 from Baptiste <baptiste.wojtkowski(a)biblibre.com> --- Created attachment 59974 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=59974&action=ed… Added unit tests to patch -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0