[koha-commits] main Koha release repository branch master updated. v20.05.00-1791-gf8206ca60c

Git repo owner gitmaster at git.koha-community.org
Tue Nov 10 15:32:41 CET 2020


This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "main Koha release repository".

The branch, master has been updated
       via  f8206ca60cb1bbd32a90b7898a6877166026b8bb (commit)
       via  bd66a2e175e062b662652f81efcafb48b6d230d7 (commit)
       via  e5ba5f406899c554ccc71212cbee5531b91c3f41 (commit)
       via  df9b697cd4a24dce2a385ba34e8c98ff4135d527 (commit)
       via  e00d07fe793e3bdc383c5a9963427a39a735b1f3 (commit)
       via  8dd313fc4ab40843210eaa32454e306cbbc20bba (commit)
       via  61a39b0dd52df4f6d743671823449e265d6add26 (commit)
       via  b854e285f1b77b62bb8b9e28c5b532e1c4dead94 (commit)
       via  aebf7f2756c585512576ea5dc3ff03f17ba1610a (commit)
       via  2de7a4c04e4924ee316623f8ab89be8e16461ee4 (commit)
       via  3c388b88c4e6638d545dd0c99574107f9af7477a (commit)
       via  27d64e1720f79d95013de80278fcd71fbf765c04 (commit)
       via  4defe532df94d515c850423c2f9b0a18c9dfdbae (commit)
       via  55ac67d95b6b4cd2459385a7aae2e24de410925a (commit)
       via  838be5e5168e96f1c0f212019af4909abb42f5c2 (commit)
       via  87e305a401d778f1d28bc74086d050ea8f42f7a2 (commit)
       via  b676dd376bd3695db1581d0ad4a883b5ac286f1a (commit)
       via  e7587f6c8bfa4e992408cfa16bb835e9edfdc1a3 (commit)
       via  eb283d13fab70d8a32216a5bee8fb4a71e6d875e (commit)
       via  d01f78e2d573076df71e0505548193da736b05bd (commit)
       via  b46c1a037809a92c6ee0667dd5e559dc2f743f6a (commit)
       via  4dfa570936db87dfe79fcb0a8830054065efa077 (commit)
       via  0ad4e7c7c3904ad9e2feec9f6fb0ffb274998491 (commit)
       via  6f1aa37cc5bfd7ec0e3f29ce74657ba62867c45c (commit)
       via  381d46341c7061f649400975a3c5b7a008feba64 (commit)
       via  960d282e3b99ae5f4e7a6522824e0fa1edb394ed (commit)
       via  9bf00d32489edf78db92139d2d87841b6e970882 (commit)
       via  9c709b871f5f5c2887eefb81a3f93a8ad76fb8d0 (commit)
       via  8d2259b67443f75675733d41773d153d889dffd7 (commit)
       via  904e926ba0f407b24aa3d94be5afe37b5e3ec075 (commit)
      from  2ad424704fc2ec7c6978fb24c1a292c52d188659 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit f8206ca60cb1bbd32a90b7898a6877166026b8bb
Author: Kyle M Hall <kyle at bywatersolutions.com>
Date:   Thu Nov 5 06:48:04 2020 -0500

    Bug 26594: (QA follow-up) Make _UpdateBorrowerDebarmentFlags a public method
    
    Signed-off-by: Jonathan Druart <jonathan.druart at bugs.koha-community.org>

commit bd66a2e175e062b662652f81efcafb48b6d230d7
Author: Fridolin Somers <fridolin.somers at biblibre.com>
Date:   Thu Oct 1 14:19:05 2020 +0200

    Bug 26594: Fix patrons merge problem with restrictions
    
    When merging a patron A with restriction(s) into an other patron B,
    the entries of borrower_debarments are OK but the value of borrowers.debarred for patron B need to be updated.
    An effect of this strange storage of restrictions in both places.
    
    Test plan :
    1) Create a patron A with a manual restriction with some date and
       comment
    2) Create a patron B with no restriction
    3) Merge patron A and B, keeping patron B
    4) Look at patron B details page
    => Without patch you see no restriction
    => With patch you see the restriction from patron A
    
    Signed-off-by: David Nind <david at davidnind.com>
    
    Signed-off-by: Katrin Fischer <katrin.fischer.83 at web.de>
    
    Signed-off-by: Kyle M Hall <kyle at bywatersolutions.com>
    
    Signed-off-by: Jonathan Druart <jonathan.druart at bugs.koha-community.org>

commit e5ba5f406899c554ccc71212cbee5531b91c3f41
Author: Fridolin Somers <fridolin.somers at biblibre.com>
Date:   Fri Oct 2 09:22:36 2020 +0200

    Bug 26594: add Unit Test
    
    Run prove t/db_dependent/Patron/Borrower_Debarments.t
    
    Signed-off-by: David Nind <david at davidnind.com>
    
    Signed-off-by: Katrin Fischer <katrin.fischer.83 at web.de>
    
    Signed-off-by: Kyle M Hall <kyle at bywatersolutions.com>
    
    Signed-off-by: Jonathan Druart <jonathan.druart at bugs.koha-community.org>

commit df9b697cd4a24dce2a385ba34e8c98ff4135d527
Author: Jonathan Druart <jonathan.druart at bugs.koha-community.org>
Date:   Tue Nov 10 13:32:09 2020 +0000

    Bug 23916: DBRev 20.06.00.065
    
    Signed-off-by: Jonathan Druart <jonathan.druart at bugs.koha-community.org>

commit e00d07fe793e3bdc383c5a9963427a39a735b1f3
Author: Tomas Cohen Arazi <tomascohen at theke.io>
Date:   Tue Nov 10 08:53:16 2020 -0300

    Bug 23916: Allow embedding the issuer object
    
    Signed-off-by: Tomas Cohen Arazi <tomascohen at theke.io>
    
    Signed-off-by: Jonathan Druart <jonathan.druart at bugs.koha-community.org>

commit 8dd313fc4ab40843210eaa32454e306cbbc20bba
Author: Jonathan Druart <jonathan.druart at bugs.koha-community.org>
Date:   Tue Nov 10 14:45:57 2020 +0100

    Bug 23916: (follow-up) Adapt all the things to the new column and accessor names
    
    Signed-off-by: Jonathan Druart <jonathan.druart at bugs.koha-community.org>

commit 61a39b0dd52df4f6d743671823449e265d6add26
Author: Tomas Cohen Arazi <tomascohen at theke.io>
Date:   Tue Nov 10 08:47:29 2020 -0300

    Bug 23916: (QA follow-up) Adapt all the things to the new column and accessor names
    
    Signed-off-by: Tomas Cohen Arazi <tomascohen at theke.io>
    
    Signed-off-by: Jonathan Druart <jonathan.druart at bugs.koha-community.org>

commit b854e285f1b77b62bb8b9e28c5b532e1c4dead94
Author: Tomas Cohen Arazi <tomascohen at theke.io>
Date:   Tue Nov 10 08:46:43 2020 -0300

    Bug 23916: Add new attribute to API
    
    Signed-off-by: Tomas Cohen Arazi <tomascohen at theke.io>
    
    Signed-off-by: Jonathan Druart <jonathan.druart at bugs.koha-community.org>

commit aebf7f2756c585512576ea5dc3ff03f17ba1610a
Author: Tomas Cohen Arazi <tomascohen at theke.io>
Date:   Tue Nov 10 08:46:18 2020 -0300

    Bug 23916: (QA follow-up) Rename issuer => issuer_id [DB]
    
    Signed-off-by: Tomas Cohen Arazi <tomascohen at theke.io>
    
    Signed-off-by: Jonathan Druart <jonathan.druart at bugs.koha-community.org>

commit 2de7a4c04e4924ee316623f8ab89be8e16461ee4
Author: Jonathan Druart <jonathan.druart at bugs.koha-community.org>
Date:   Mon Nov 9 14:24:22 2020 +0100

    Bug 23916: (follow-up) Add unit tests
    
    Fix perlcritic error
    Subroutine "new" called using indirect syntax at line 128, column 14.  See page 349 of PBP.  (Severity: 4)
    
    Signed-off-by: Tomas Cohen Arazi <tomascohen at theke.io>
    
    Signed-off-by: Jonathan Druart <jonathan.druart at bugs.koha-community.org>

commit 3c388b88c4e6638d545dd0c99574107f9af7477a
Author: Nick Clemens <nick at bywatersolutions.com>
Date:   Sat Oct 24 02:56:15 2020 +0000

    Bug 23916: (QA follow-up) Remove stray changes and fix typo
    
    There were a couple changes that had no effect, so cleaned those up
    
    Typo 'is' for 'if'
    
    Signed-off-by: Nick Clemens <nick at bywatersolutions.com>
    Signed-off-by: Tomas Cohen Arazi <tomascohen at theke.io>
    
    Signed-off-by: Jonathan Druart <jonathan.druart at bugs.koha-community.org>

commit 27d64e1720f79d95013de80278fcd71fbf765c04
Author: Andrew Isherwood <andrew.isherwood at ptfs-europe.com>
Date:   Fri Oct 23 11:55:44 2020 +0100

    Bug 23916: (follow-up) Fix unit test
    
    This commit responds to the comment made by Katrin in comment #73. I
    have removed the lines cited as causing the contraint violation. The
    were added in the original iteration of the bug patches and, despite
    spending time trying to get to the bottom of it, I cannot figure out
    why. There are no changes in the patchset relating to Koha/Patron.pm and
    removing the lines does not cause any of the tests in files that *are*
    affected by this patchset to fail. I do not know why these lines were
    ever added in the first place, unfortunately I did not add comments
    explaining (lesson learned)!
    
    Signed-off-by: Nick Clemens <nick at bywatersolutions.com>
    Signed-off-by: Tomas Cohen Arazi <tomascohen at theke.io>
    
    Signed-off-by: Jonathan Druart <jonathan.druart at bugs.koha-community.org>

commit 4defe532df94d515c850423c2f9b0a18c9dfdbae
Author: Andrew Isherwood <andrew.isherwood at ptfs-europe.com>
Date:   Mon Oct 19 12:55:18 2020 +0100

    Bug 23916: (follow-up) Rebase unit tests
    
    This commit is a response to Katrin's comments in comment #62:
    
    - Fixed merge conflict
    
    It also fixes a test which now fails due to an upstream change in
    C4::Circulation
    
    Signed-off-by: Nick Clemens <nick at bywatersolutions.com>
    Signed-off-by: Tomas Cohen Arazi <tomascohen at theke.io>
    
    Signed-off-by: Jonathan Druart <jonathan.druart at bugs.koha-community.org>

commit 55ac67d95b6b4cd2459385a7aae2e24de410925a
Author: Andrew Isherwood <andrew.isherwood at ptfs-europe.com>
Date:   Mon Oct 12 10:28:33 2020 +0100

    Bug 23916: (follow-up) Fix terminology, use patron-title and make column consistent in issues and old_issues
    
    This commit makes the changes suggested by Katrin in comment #50:
    
    - Changed syspref from RecordIssuer to RecordStaffUserOnCheckout
    - Changed terminology from "issue" to "check out" and variations
    - Fixed name display to use patron-title.inc
    - Made issuer column DEFAULT NULL consistently between issues and
    old_issues and between the DB update and kohastructure.sql
    
    Signed-off-by: Nick Clemens <nick at bywatersolutions.com>
    Signed-off-by: Tomas Cohen Arazi <tomascohen at theke.io>
    
    Signed-off-by: Jonathan Druart <jonathan.druart at bugs.koha-community.org>

commit 838be5e5168e96f1c0f212019af4909abb42f5c2
Author: Andrew Isherwood <andrew.isherwood at ptfs-europe.com>
Date:   Thu Sep 24 13:55:55 2020 +0100

    Bug 23916: (follow-up) Don't anonymise issuer and don't update action_logs on upgrade
    
    This commit implements the two suggestions made by Nick in comment #41:
    
    - Removes the attempted retrospective addition of issuers to old issues.
    It was not particularly reliable, it also is not appropriate if the user
    does not wish to make use of this functionality
    
    - Removes the conversion of a NULL issuer to the anonymous borrowernumber when
    anonymising checkouts
    
    Signed-off-by: Nick Clemens <nick at bywatersolutions.com>
    Signed-off-by: Tomas Cohen Arazi <tomascohen at theke.io>
    
    Signed-off-by: Jonathan Druart <jonathan.druart at bugs.koha-community.org>

commit 87e305a401d778f1d28bc74086d050ea8f42f7a2
Author: Andrew Isherwood <andrew.isherwood at ptfs-europe.com>
Date:   Mon Nov 18 12:30:27 2019 +0000

    Bug 23916: (follow-up) Fix column name collision
    
    Seems that joining 'borrowers' into the query run in
    C4::Members::GetAllIssues caused a column name collision, which blatted
    the retrieval of issues.branchcode. So we now are being a bit more
    specific in what is coming from where in the query.
    
    Signed-off-by: Ben Veasey <B.T.Veasey at lboro.ac.uk>
    Signed-off-by: Bouzid Fergani <bouzid.fergani at inlibro.com>
    
    Signed-off-by: Nick Clemens <nick at bywatersolutions.com>
    Signed-off-by: Tomas Cohen Arazi <tomascohen at theke.io>
    
    Signed-off-by: Jonathan Druart <jonathan.druart at bugs.koha-community.org>

commit b676dd376bd3695db1581d0ad4a883b5ac286f1a
Author: Andrew Isherwood <andrew.isherwood at ptfs-europe.com>
Date:   Thu Oct 31 14:26:18 2019 +0000

    Bug 23916: Add unit tests
    
    This patch adds unit tests for the new functions
    
    Signed-off-by: Ben Veasey <B.T.Veasey at lboro.ac.uk>
    Signed-off-by: Bouzid Fergani <bouzid.fergani at inlibro.com>
    
    Signed-off-by: Nick Clemens <nick at bywatersolutions.com>
    Signed-off-by: Tomas Cohen Arazi <tomascohen at theke.io>
    
    Signed-off-by: Jonathan Druart <jonathan.druart at bugs.koha-community.org>

commit e7587f6c8bfa4e992408cfa16bb835e9edfdc1a3
Author: Andrew Isherwood <andrew.isherwood at ptfs-europe.com>
Date:   Thu Oct 31 10:45:41 2019 +0000

    Bug 23916: Anonymise 'issuer' when required
    
    This patch adds the anonymisation of 'old_issues.issuer' alongside the
    existing anonymisation of 'old_issues.borrowernumber'
    
    Signed-off-by: Ben Veasey <B.T.Veasey at lboro.ac.uk>
    Signed-off-by: Bouzid Fergani <bouzid.fergani at inlibro.com>
    
    Signed-off-by: Nick Clemens <nick at bywatersolutions.com>
    Signed-off-by: Tomas Cohen Arazi <tomascohen at theke.io>
    
    Signed-off-by: Jonathan Druart <jonathan.druart at bugs.koha-community.org>

commit eb283d13fab70d8a32216a5bee8fb4a71e6d875e
Author: Andrew Isherwood <andrew.isherwood at ptfs-europe.com>
Date:   Mon Mar 2 11:04:59 2020 +0000

    Bug 23916: Record and display item issuer
    
    This patch adds the recording and display of the item issuer. This
    behaviour is governed by the RecordIssuer syspref, if disabled (the
    default), no recording or display of issuer will take place.
    
    Signed-off-by: Ben Veasey <B.T.Veasey at lboro.ac.uk>
    Signed-off-by: Bouzid Fergani <bouzid.fergani at inlibro.com>
    
    Signed-off-by: Nick Clemens <nick at bywatersolutions.com>
    Signed-off-by: Tomas Cohen Arazi <tomascohen at theke.io>
    
    Signed-off-by: Jonathan Druart <jonathan.druart at bugs.koha-community.org>

commit d01f78e2d573076df71e0505548193da736b05bd
Author: Andrew Isherwood <andrew.isherwood at ptfs-europe.com>
Date:   Thu Oct 31 10:22:24 2019 +0000

    Bug 23916: Add "RecordIssuer" syspref
    
    This patch adds the "RecordIssuer" syspref, which is disabled by default
    
    Signed-off-by: Ben Veasey <B.T.Veasey at lboro.ac.uk>
    Signed-off-by: Bouzid Fergani <bouzid.fergani at inlibro.com>
    
    Signed-off-by: Nick Clemens <nick at bywatersolutions.com>
    Signed-off-by: Tomas Cohen Arazi <tomascohen at theke.io>
    
    Signed-off-by: Jonathan Druart <jonathan.druart at bugs.koha-community.org>

commit b46c1a037809a92c6ee0667dd5e559dc2f743f6a
Author: Andrew Isherwood <andrew.isherwood at ptfs-europe.com>
Date:   Thu Oct 31 10:08:42 2019 +0000

    Bug 23916: Add issues.issuer column and FK
    
    This patch adds the issues.issuer column which is a foreign key to
    borrowers.borrowernumber
    
    Signed-off-by: Ben Veasey <B.T.Veasey at lboro.ac.uk>
    Signed-off-by: Bouzid Fergani <bouzid.fergani at inlibro.com>
    
    Signed-off-by: Nick Clemens <nick at bywatersolutions.com>
    Signed-off-by: Tomas Cohen Arazi <tomascohen at theke.io>
    
    Signed-off-by: Jonathan Druart <jonathan.druart at bugs.koha-community.org>

commit 4dfa570936db87dfe79fcb0a8830054065efa077
Author: Martin Renvoize <martin.renvoize at ptfs-europe.com>
Date:   Fri Oct 16 15:57:30 2020 +0100

    Bug 26697: Make account.inc consistent between staff and opac
    
    Test plan - Regression
    1/ Login to the OPAC as a user with various account charges and payments.
    2/ Navigate to the 'Your charges' page.
    3/ Compare the display of the table before and after applying the
    patchset. They should match.
    
    Test plan - Sync
    1/ Compare koha-tmpl/intranet-tmpl/prog/en/includes/accounts.inc with
    koha-tmpl/opac-tmpl/bootstrap/en/includes/accounts.inc.
    2/ They files should match after the patch is applied.
    
    Test plan - Translation
    1) ./translate update fr-CA
    2) Open fr-CA-opac-bootstrap.po and translated this part
    
    msgid ""
    "%s %s %sPayment %sWriteoff %sForgiven %sCredit %sLost item fee refund "
    "%sRefund %s%s %s %s %s %sAccount creation fee %sAccount renewal fee
    %sLost "
    "item %sManual fee %sNew card %sFine %sLost item processing fee %sRental
    fee "
    "%sDaily rental fee %sRenewal of rental item %sRenewal of daily rental
    item "
    "%sHold fee %sHold waiting too long %s%s %s %s %s "
    
    3) ./translate install fr-CA
    4) Login to the OPAC as a patron with various charges
    5) Check 'My charges' (in fr-CA) to confirm the translations have been
       picked up.
    
    Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose at inlibro.com>
    Signed-off-by: Katrin Fischer <katrin.fischer.83 at web.de>
    
    Signed-off-by: Jonathan Druart <jonathan.druart at bugs.koha-community.org>

commit 0ad4e7c7c3904ad9e2feec9f6fb0ffb274998491
Author: Jonathan Druart <jonathan.druart at bugs.koha-community.org>
Date:   Tue Nov 10 13:32:09 2020 +0000

    Bug 24603: DBRev 20.06.00.064
    
    Signed-off-by: Jonathan Druart <jonathan.druart at bugs.koha-community.org>

commit 6f1aa37cc5bfd7ec0e3f29ce74657ba62867c45c
Author: Jonathan Druart <jonathan.druart at bugs.koha-community.org>
Date:   Thu Nov 5 14:40:29 2020 +0100

    Bug 24603: Simplify tests using TestBuilder
    
    Signed-off-by: Jonathan Druart <jonathan.druart at bugs.koha-community.org>

commit 381d46341c7061f649400975a3c5b7a008feba64
Author: Jonathan Druart <jonathan.druart at bugs.koha-community.org>
Date:   Thu Nov 5 14:39:53 2020 +0100

    Bug 24603: Adjust permissions for cancel-charge.pl
    
    members/cancel-charge.pl should have the same permissions check than boraccount
    (borrowers => edit_borrowers was missing)
    
    Signed-off-by: Jonathan Druart <jonathan.druart at bugs.koha-community.org>

commit 960d282e3b99ae5f4e7a6522824e0fa1edb394ed
Author: Martin Renvoize <martin.renvoize at ptfs-europe.com>
Date:   Fri Oct 16 16:23:10 2020 +0100

    Bug 24603: (QA follow-up) Add translation to OPAC
    
    Signed-off-by: Martin Renvoize <martin.renvoize at ptfs-europe.com>
    
    Signed-off-by: Jonathan Druart <jonathan.druart at bugs.koha-community.org>

commit 9bf00d32489edf78db92139d2d87841b6e970882
Author: Katrin Fischer <katrin.fischer.83 at web.de>
Date:   Mon Oct 5 13:24:40 2020 +0000

    Bug 24603: (QA follow-up) Make the new credit type translatable and shorten description a bit
    
    Adding the new offset type and credit type to the include so it can be translated.
    
    Also suggest shortening the db description a bit.
    
    Signed-off-by: Katrin Fischer <katrin.fischer.83 at web.de>
    
    https://bugs.koha-community.org/show_bug.cgi?id=24063
    
    Signed-off-by: Jonathan Druart <jonathan.druart at bugs.koha-community.org>

commit 9c709b871f5f5c2887eefb81a3f93a8ad76fb8d0
Author: Martin Renvoize <martin.renvoize at ptfs-europe.com>
Date:   Fri Jul 10 14:49:35 2020 +0100

    Bug 24603: (follow-up) Update to double entry accounting
    
    This patch updates the logic to create a cancellation accountline and
    apply it to the charge line so we correction record the transaction in
    terms of double entry accounting standards.
    
    Test plan:
    1. Go to a patron's accounting section
    2. Create a manual invoice
    3. In Transactions tab, you should see a 'Cancel charge' button. Click
       on it. It should now be marked as cancelled
    4. A cancellation line should be associated with the original charge.
    5. Create another manual invoice
    6. Pay it (partially or fully)
    7. Notice that the 'Cancel charge' button is not available
    8. Void the payment
    9. 'Cancel charge' button is available again. Click on it and verify
       that it still works
    10. prove t/db_dependent/Koha/Account/Lines.t
    
    Signed-off-by: David Nind <david at davidnind.com>
    
    Signed-off-by: Katrin Fischer <katrin.fischer.83 at web.de>
    
    https://bugs.koha-community.org/show_bug.cgi?id=24063
    
    Bug 24603: Fix number of unit tests
    
    Signed-off-by: Katrin Fischer <katrin.fischer.83 at web.de>
    
    https://bugs.koha-community.org/show_bug.cgi?id=24063
    
    Signed-off-by: Jonathan Druart <jonathan.druart at bugs.koha-community.org>

commit 8d2259b67443f75675733d41773d153d889dffd7
Author: Julian Maurice <julian.maurice at biblibre.com>
Date:   Thu Feb 6 14:13:44 2020 +0100

    Bug 24603: Allow to cancel charges in patron accounting
    
    There is already a button to void a payment. It should be possible to
    cancel a charge too.
    
    This patch adds a button in patron's accounting section (Transactions
    tab) that allow to cancel charges.
    Charges that have been fully or partially paid cannot be cancelled.
    
    It also fixes Koha::Account::Line::is_credit by looking at
    credit_type_code instead of amount (amount can be 0 for voided payments)
    
    It also fixes the tests for Koha::Account::Line::void when database does
    not contain the borrowernumber 51 (the default in
    t::lib::Mocks::mock_userenv)
    
    Test plan:
    1. Go to a patron's accounting section
    2. Create a manual invoice
    3. In Transactions tab, you should see a 'Cancel charge' button. Click
       on it. It should now be marked as cancelled
    4. Create another manual invoice
    5. Pay it (partially or fully)
    6. Notice that the 'Cancel charge' button is not available
    7. Void the payment
    8. 'Cancel charge' button is available again. Click on it and verify
       that it still works
    9. prove t/db_dependent/Koha/Account/Lines.t
    
    Signed-off-by: David Nind <david at davidnind.com>
    
    Signed-off-by: David Nind <david at davidnind.com>
    
    Signed-off-by: Katrin Fischer <katrin.fischer.83 at web.de>
    
    Signed-off-by: Jonathan Druart <jonathan.druart at bugs.koha-community.org>

commit 904e926ba0f407b24aa3d94be5afe37b5e3ec075
Author: Fridolin Somers <fridolin.somers at biblibre.com>
Date:   Tue Nov 3 09:19:34 2020 +0100

    Bug 26904: OPAC password recovery allows regexp in email
    
    When using OPAC password recovery form, opac/opac-password-recovery.pl :
    if one provides correct login and an email, there is a check that this email is one of patron's.
    
    This check uses RegExp with case insensitive :
      if ( $email && !( any { /^$email$/i } @emails ) )
    
    This is a security issue since one can simply enter '.*'.
    Severity is normal because the login must be a correct.
    
    I propose to use simple string compare with lowercase to be case insensitive.
    
    Test plan :
    1) Don't apply patch
    2) Enable system preference 'OpacResetPassword'
    3) Go to 'OPAC > Log in to your account > Forgot your password?'
    4) Enter an existing userid or cardnumber and '.*' in 'Email'
    5) The password recovery is created ! (check table 'borrower_password_recovery')
    6) Apply patch
    7) Enter an existing userid or cardnumber and '.*' in 'Email'
    8) You get the message 'No account was found with the provided information.'
    9) Enter an existing userid or cardnumber and in 'Email' the corresponding email but with different case
    10) The password recovery is created (check table 'borrower_password_recovery')
    
    Signed-off-by: Nick Clemens <nick at bywatersolutions.com>
    Signed-off-by: Julian Maurice <julian.maurice at biblibre.com>
    
    Signed-off-by: Jonathan Druart <jonathan.druart at bugs.koha-community.org>

-----------------------------------------------------------------------

Summary of changes:
 C4/Circulation.pm                                  |  12 +++
 C4/Members.pm                                      |  10 +-
 Koha.pm                                            |   2 +-
 Koha/Account/Line.pm                               |  97 +++++++++++++++++-
 Koha/Checkout.pm                                   |  15 +++
 Koha/Old/Checkout.pm                               |  15 +++
 Koha/Patron.pm                                     |   4 +
 Koha/Patron/Debarments.pm                          |  14 +--
 Koha/Schema/Result/Borrower.pm                     |  34 ++++++-
 Koha/Schema/Result/Issue.pm                        |  32 +++++-
 Koha/Schema/Result/OldIssue.pm                     |  32 +++++-
 api/v1/swagger/definitions/checkout.json           |  13 ++-
 api/v1/swagger/paths/checkouts.json                |  10 +-
 installer/data/mysql/kohastructure.sql             |   9 +-
 .../data/mysql/mandatory/account_credit_types.sql  |   3 +-
 .../data/mysql/mandatory/account_offset_types.sql  |   3 +-
 installer/data/mysql/mandatory/sysprefs.sql        |   1 +
 installer/data/mysql/updatedatabase.pl             |  35 +++++++
 .../intranet-tmpl/prog/en/includes/accounts.inc    |  71 ++++++-------
 .../en/modules/admin/preferences/circulation.pref  |   7 ++
 .../prog/en/modules/catalogue/issuehistory.tt      |  10 ++
 .../prog/en/modules/members/boraccount.tt          |  17 +++-
 .../prog/en/modules/members/readingrec.tt          |   6 ++
 .../bootstrap/en/includes/account-table.inc        |  48 +--------
 .../bootstrap}/en/includes/accounts.inc            |  71 ++++++-------
 members/boraccount.pl                              |   6 ++
 members/cancel-charge.pl                           |  57 +++++++++++
 opac/opac-password-recovery.pl                     |   2 +-
 t/db_dependent/Circulation.t                       |  49 ++++++++-
 t/db_dependent/Koha/Account/Line.t                 | 111 ++++++++++++++++++++-
 t/db_dependent/Koha/Checkouts.t                    |  32 +++++-
 t/db_dependent/Patron/Borrower_Debarments.t        |  35 ++++++-
 32 files changed, 708 insertions(+), 155 deletions(-)
 copy koha-tmpl/{intranet-tmpl/prog => opac-tmpl/bootstrap}/en/includes/accounts.inc (81%)
 create mode 100755 members/cancel-charge.pl


hooks/post-receive
-- 
main Koha release repository


More information about the koha-commits mailing list