March 2008 - Koha-bugs - lists.koha-community.org

[Bug 1953] New: remove possible SQL injection attacks
by bugzilla-daemon＠pippin.metavore.com 18 Mar '08

18 Mar '08

http://bugs.koha.org/cgi-bin/bugzilla/show_bug.cgi?id=1953 Summary: remove possible SQL injection attacks Product: Koha Version: unspecified Platform: All OS/Version: All Status: NEW Severity: normal Priority: P3 Component: Database AssignedTo: Andrew.moore(a)liblime.com ReportedBy: Andrew.moore(a)liblime.com QAContact: koha-bugs(a)nongnu.org I've found a handful of SQL queries that don't use placeholders and bind variables, but instead have variables passed directly into them. These may allow SQL injection attacks. I plan on refactoring them so that they use placeholders instead. ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0

[Bug 1889] Virtual shelves leave blank field in staff intranet when BIB is deleted
by bugzilla-daemon＠pippin.metavore.com 18 Mar '08

18 Mar '08

http://bugs.koha.org/cgi-bin/bugzilla/show_bug.cgi?id=1889 ------- Comment #5 from galen.charlton(a)liblime.com 2008-03-18 13:05 ------- OK, it turns out the FK relationship between virtualshelfcontents and biblio already exists in the 3.0 codebase, and has existed for a long time. Deleting a bib in my current test DB removes the entry from the list, so this is a WORKSFORME as far as Koha 3.0 HEAD is concerned. I checked the SMFPL test database, and it appears that for some reason the constraint is not present. Can you confirm that the database was upgraded from a 2.2.9 installation - it's possible that the problem ultimately lies in the upgrade process. ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0

[Bug 1889] Virtual shelves leave blank field in staff intranet when BIB is deleted
by bugzilla-daemon＠pippin.metavore.com 18 Mar '08

18 Mar '08

http://bugs.koha.org/cgi-bin/bugzilla/show_bug.cgi?id=1889 galen.charlton(a)liblime.com changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED ------- Comment #4 from galen.charlton(a)liblime.com 2008-03-18 12:34 ------- I think the simplest solution is to add a FK relationship between biblio and virtualshelves - there's no reason I can think of for a list to refer to bibs that no longer exist, nor any reason for the presence of a bib on a list to prevent deletion of the bib. ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0

[Bug 1695] Patron image lost if card number is changed
by bugzilla-daemon＠pippin.metavore.com 18 Mar '08

18 Mar '08

http://bugs.koha.org/cgi-bin/bugzilla/show_bug.cgi?id=1695 cnighswonger(a)foundations.edu changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |WORKSFORME ------- Comment #3 from cnighswonger(a)foundations.edu 2008-03-18 11:17 ------- Actually this should not be an issue now. The patronimage table has a foreign key relationship on cardnumber which causes it to update anytime the borrower.cardnumber field is updated. ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0

[Bug 1949] Bibliographic Address isn't properly displayed on OPAC result page
by bugzilla-daemon＠pippin.metavore.com 18 Mar '08

18 Mar '08

http://bugs.koha.org/cgi-bin/bugzilla/show_bug.cgi?id=1949 ------- Comment #3 from frederic(a)tamil.fr 2008-03-18 10:28 ------- Great news! Thanks Owen. hdl: You're correct, there is a difficulty with subfield repetitions in general. I would add that there is also an issue with the differences in cataloging rules between UNIMARC and MARC21. In MARC21, separators are entered by cataloger, whereas in UNIMARC they are not. My MARC21 example: 260 $aLondon,$aBoston :$bRoutledge & Kegan Paul,$c1974. look somehow like that in UNIMARC: 210 $aLondon$aBoston$bRoutledge & Kegan Paul$c1974 There are no punctuation marks at all. It's great from an IT perspective since data storing is fully separated from data representation/display. But it requires a different handling of MARC21 and UNIMARC biblio records. In UNIMARC it would be necessary that template add separators which are not in record fields. ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0

[Bug 1936] Main Intranet template needs link corrected
by bugzilla-daemon＠pippin.metavore.com 18 Mar '08

18 Mar '08

http://bugs.koha.org/cgi-bin/bugzilla/show_bug.cgi?id=1936 oleonard(a)myacpl.org changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0

[Bug 1949] Bibliographic Address isn't properly displayed on OPAC result page
by bugzilla-daemon＠pippin.metavore.com 18 Mar '08

18 Mar '08

http://bugs.koha.org/cgi-bin/bugzilla/show_bug.cgi?id=1949 ------- Comment #2 from oleonard(a)myacpl.org 2008-03-18 09:50 ------- I've corrected all but the subfield repetitions issue, will submit a patch later today. ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0

[Bug 1951] OPACURLOpenInNewWindow doesn't do anything
by bugzilla-daemon＠pippin.metavore.com 18 Mar '08

18 Mar '08

1 0

[Bug 1949] Bibliographic Address isn't properly displayed on OPAC result page
by bugzilla-daemon＠pippin.metavore.com 18 Mar '08

18 Mar '08

http://bugs.koha.org/cgi-bin/bugzilla/show_bug.cgi?id=1949 ------- Comment #1 from henridamien(a)koha-fr.org 2008-03-18 09:23 ------- * Subfield repetitions mustn't be separated by a pipe: London, | Boston : incorrect London, Boston : correct This would be quite hard to achieve since detail view mostly uses fields and in this case publicationplace field and it is taken for granted that repeated field values are separated by | Or then, we choose to separate repeated subfields through ", " Or replace | by ' ' But this wouldnot be satisfying. You can find a workaround with summaries for itemtypes (same structure as ISBD But {} are replaced by [] and there are no #fields) ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0

[Bug 1950] Editions listing should exclude the currently-viewed title
by bugzilla-daemon＠pippin.metavore.com 18 Mar '08

18 Mar '08

http://bugs.koha.org/cgi-bin/bugzilla/show_bug.cgi?id=1950 jmf(a)liblime.com changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P3 |PATCH-Sent ------- Comment #1 from jmf(a)liblime.com 2008-03-18 08:46 ------- Just pushed up a patch, please close if it fixes this issue. ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0