November 2010 - Koha-bugs - lists.koha-community.org

[Bug 5131] New: XSS vulnerability in the OPAC search results interface
by bugzilla-daemon＠bugs.koha-community.org 04 Aug '11

04 Aug '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5131 Summary: XSS vulnerability in the OPAC search results interface Change sponsored?: --- Product: Koha Version: HEAD Platform: All OS/Version: All Status: NEW Severity: critical Priority: P5 Component: OPAC AssignedTo: oleonard(a)myacpl.org ReportedBy: robin(a)catalyst.net.nz QAContact: koha-bugs(a)lists.koha-community.org Estimated Hours: 0.0 In opac-search.pl: foreach my $sort (@sort_by) { $template->param($sort => 1); # FIXME: security hole. can set any TMPL_VAR here } This makes it pretty easy for someone to do things like inject arbitrary HTML and Javascript, and so steal the credentials of another user. This operation needs a whitelist of valid values that it checks against. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA contact for the bug.

1 9

[Bug 5320] New: Estimate optionally next planned date for serials without periodicity
by bugzilla-daemon＠bugs.koha-community.org 03 Aug '11

03 Aug '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5320 Summary: Estimate optionally next planned date for serials without periodicity Change sponsored?: --- Product: Koha Version: rel_3_2 Platform: All OS/Version: All Status: ASSIGNED Severity: enhancement Priority: PATCH-Sent Component: Serials AssignedTo: m.de.rooy(a)rijksmuseum.nl ReportedBy: m.de.rooy(a)rijksmuseum.nl QAContact: koha-bugs(a)lists.koha-community.org Estimated Hours: 0.0 For periodicity Irregular, Unknown or "Without periodicity", it would be helpful if Koha could suggest a next planned date when receiving an issue based on the time interval between the last two receivals of this serial. This option is triggered by new local-use preference SerialEstimatePlannedDate. If this option exists and contains uppercase W for without periodicity, I for irregular or U for unknown, or a combination of those characters, the option is enabled for these particular periodicities. Behavior does not change for other periodicities. Implemented by some small changes in C4/Serials.pm, routine GetNextDate. Patch has been sent. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA contact for the bug.

1 7

[Bug 5053] New: singleBranchMode should control branch display all over
by bugzilla-daemon＠bugs.koha-community.org 02 Aug '11

02 Aug '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5053 Summary: singleBranchMode should control branch display all over Change sponsored?: --- Product: Koha Version: HEAD Platform: All OS/Version: All Status: NEW Severity: enhancement Priority: P5 Component: System Administration AssignedTo: paul.poulain(a)biblibre.com ReportedBy: nengard(a)gmail.com QAContact: koha-bugs(a)lists.koha-community.org CC: gmcharlt(a)gmail.com Estimated Hours: 0.0 When singleBranchMode is turned on all displays of multiple branches should be turned off: * Location on holdings in OPAC should only show shelving location * Location on holdings in Staff Client should only show shelving location * Branch selection pull downs should be hidden (everywhere) * Branch display in XSLT search results shouldn't appear There may be more I can add to this, but basic idea is that if there is one branch there is no reason to tell people what branch things are at. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA contact for the bug.

1 1

[Bug 5418] New: New itemBarcodeInputFilter for libsuite8 style barcodes
by bugzilla-daemon＠bugs.koha-community.org 02 Aug '11

02 Aug '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5418 Summary: New itemBarcodeInputFilter for libsuite8 style barcodes Change sponsored?: --- Product: Koha Version: unspecified Platform: All OS/Version: All Status: NEW Severity: enhancement Priority: P5 Component: Circulation AssignedTo: kyle.m.hall(a)gmail.com ReportedBy: kmkale(a)anantcorp.com QAContact: koha-bugs(a)lists.koha-community.org CC: gmcharlt(a)gmail.com Estimated Hours: 0.0 In India a ILS product called Libsuite8 prints barcodes like b0007432. The barcode is not stored anywhere in libsuite8's database. Neither is barcode available in any of the reports generated by the software. The barcode 'b0007432' when scanned into the libsuite8 software is de-constructed like 'b' which is the itemtype i.e. Book in this instance, and '7432' which is the 'Accession Number'. The software then takes the logged in staff's branchcode and does a join on three tables 'Location', 'Media_Type', and 'Books' to retrieve the particular record from the database. There is no possibility of recreating the barcodes for insertion in Koha while doing a retrospective conversion, because of arbitrary length of the barcode string AND arbitrary number of zeros in the numeric part of the printed barcode AND the fact that there are no reports available from the software which contain barcodes AND the fact that the barcode is not stored in the database. But most importantly due to the simple fact that printed barcodes are duplicated among branches. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA contact for the bug.

1 22

[Bug 5164] New: overdue script and csv
by bugzilla-daemon＠bugs.koha-community.org 01 Aug '11

01 Aug '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5164 Summary: overdue script and csv Change sponsored?: --- Product: Koha Version: unspecified Platform: All OS/Version: All Status: NEW Severity: enhancement Priority: P5 Component: Command-line Utilities AssignedTo: gmcharlt(a)gmail.com ReportedBy: nahuel.angelinetti(a)biblibre.com QAContact: koha-bugs(a)lists.koha-community.org Estimated Hours: 0.0 The CSV sent by email contains 2 times the column name, and it contains empty lines, that break the publiposting. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA contact for the bug.

1 7

[Bug 4846] New: Pending Holds/Reserves lists undefined item
by bugzilla-daemon＠bugs.koha-community.org 01 Aug '11

01 Aug '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=4846 Summary: Pending Holds/Reserves lists undefined item Change sponsored?: --- Product: Koha Version: rel_3_0 Platform: All URL: http://10.100.30.53:8080/cgi-bin/koha/circ/pendingrese rves.pl OS/Version: All Status: NEW Severity: normal Priority: P5 Component: Circulation AssignedTo: kyle.m.hall(a)gmail.com ReportedBy: cbrannon(a)cdalibrary.org QAContact: koha-bugs(a)lists.koha-community.org CC: gmcharlt(a)gmail.com Estimated Hours: 0.0 In 3.0.6, if I have an item listed in the "Holds to pull", it adds a second item in the list called "undefined". The link for this item is http://10.100.30.53:8080/cgi-bin/koha/catalogue/detail.pl?biblionumber=unde…. This listing disappears when there are no items in the list. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA contact for the bug.

1 1

[Bug 4995] New: extended attributes replication from LDAP
by bugzilla-daemon＠bugs.koha-community.org 29 Jul '11

29 Jul '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=4995 Summary: extended attributes replication from LDAP Change sponsored?: --- Product: Koha Version: rel_3_0 Platform: All OS/Version: All Status: NEW Severity: enhancement Priority: P5 Component: Authentication AssignedTo: gmcharlt(a)gmail.com ReportedBy: dpavlin(a)rot13.org QAContact: koha-bugs(a)lists.koha-community.org CC: dpavlin(a)rot13.org Estimated Hours: 0.0 Documentation for extended attributes is somewhat lacking, and my last patch in my previous bug report just fixed case without any extended attributes in LDAP. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA contact for the bug.

1 9

[Bug 5215] New: Barcode field not cleared when using "Add and Duplicate" option on additem.pl
by bugzilla-daemon＠bugs.koha-community.org 22 Jul '11

22 Jul '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5215 Summary: Barcode field not cleared when using "Add and Duplicate" option on additem.pl Change sponsored?: --- Product: Koha Version: rel_3_2 Platform: All OS/Version: All Status: NEW Severity: major Priority: P5 Component: Cataloging AssignedTo: gmcharlt(a)gmail.com ReportedBy: cnighswonger(a)foundations.edu QAContact: koha-bugs(a)lists.koha-community.org CC: ian.walls(a)bywatersolutions.com Estimated Hours: 0.0 The barcode field is not cleared/incremented properly when using the "Add and Duplicate" option. Rather it is pre-populated with the previously used barcode which causes additem.pl to return a duplicate barcode error if the cataloger does not catch the mistake. The problem is caused by the fact that the current item record is simply duplicated and re-loaded into the form. The solution is to add code which either pre-populates with the next barcode number if the incremental pattern is set or clears the p subfield if one of the various patterns using the javascript plugin is selected. A pull request with an implementation of this will follow. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA contact for the bug.

1 10

[Bug 4863] New: Bookfund.pm lacks use C4::Context
by bugzilla-daemon＠bugs.koha-community.org 19 Jul '11

19 Jul '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=4863 Summary: Bookfund.pm lacks use C4::Context Change sponsored?: --- Product: Koha Version: rel_3_0 Platform: All OS/Version: All Status: NEW Severity: major Priority: P5 Component: Acquisitions AssignedTo: henridamien(a)koha-fr.org ReportedBy: evelio(a)masmedios.com QAContact: koha-bugs(a)lists.koha-community.org Estimated Hours: 0.0 After installing koha community 3.0.6 we have a 500 error invoking the following URL on our internal server http://koha2:8088/cgi-bin/koha/acqui/acqui-home.pl change the exchange rate and save, it redirects to http://koha2:8088/cgi-bin/koha/acqui/currency.pl?type=change&CAD=1.29540&ty… and then get the 500 error. Logs says [Wed Jun 09 10:53:36 2010] [error] [client 192.168.x.y] Can't locate object method "dbh" via package "C4::Context" (perhaps you forgot to load "C4::Context"?) at /home/www/koha_bage/lib/C4/Bookfund.pm line 399., referer: http://koha2:8088/cgi-bin/koha/acqui/acqui-home.pl [Wed Jun 09 10:53:36 2010] [error] [client 192.168.x.y] Premature end of script headers: currency.pl, referer: http://koha2:8088/cgi-bin/koha/acqui/acqui-home.pl we have fixed adding the following line at the begining of the file Bookfund.pm use C4::Context; -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA contact for the bug.

1 2

[Bug 5431] New: Separate state field for library addresses
by bugzilla-daemon＠bugs.koha-community.org 17 Jul '11

17 Jul '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5431 Summary: Separate state field for library addresses Change sponsored?: --- Product: Koha Version: rel_3_4 Platform: All URL: /cgi-bin/koha/admin/branches.pl OS/Version: All Status: NEW Severity: enhancement Priority: P5 Component: System Administration AssignedTo: paul.poulain(a)biblibre.com ReportedBy: oleonard(a)myacpl.org QAContact: koha-bugs(a)lists.koha-community.org CC: gmcharlt(a)gmail.com Estimated Hours: 0.0 If the proposed changes for Bug 5422 are accepted, the same change should be made to the way library addresses are stored. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA contact for the bug.

1 17