July 2011 - Koha-bugs - lists.koha-community.org

[Bug 6451] New: Alert staff to new comments, purchase suggestions and tags at login
by bugzilla-daemon＠bugs.koha-community.org 07 Dec '11

07 Dec '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6451 Bug #: 6451 Summary: Alert staff to new comments, purchase suggestions and tags at login Classification: Unclassified Change sponsored?: --- Product: Koha Version: rel_3_6 Platform: All OS/Version: All Status: NEW Severity: enhancement Priority: P5 Component: Staff Client AssignedTo: paul.poulain(a)biblibre.com ReportedBy: viktor.sarge(a)regionhalland.se QAContact: koha-bugs(a)lists.koha-community.org CC: gmcharlt(a)gmail.com Created attachment 4352 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=4352 Screenshot of mockup implementation We have noticed that it's quite possible to forget to check the moderation queue and I would like to propose the solution to alert the staff to new items in the queue directly at the home screen. It could be done as easily as: " New interactions - please moderate: Tags (5) Comments (7) Purchase suggestions (1) " I used Firebug to create a quick screenshot of how it might look implemented (attached). Please excuse my ignorance should this functionality already be in place. I usually let my vendor handle RFC's but I couldn't resist the temptation to post one myself :) -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.

1 2

[Bug 6629] New: [security] insecure use of Cookie for language selection
by bugzilla-daemon＠bugs.koha-community.org 04 Dec '11

04 Dec '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6629 Bug #: 6629 Summary: [security] insecure use of Cookie for language selection Classification: Unclassified Change sponsored?: --- Product: Koha Version: unspecified Platform: All OS/Version: All Status: NEW Severity: critical Priority: P5 Component: Architecture, internals, and plumbing AssignedTo: gmcharlt(a)gmail.com ReportedBy: semarie-koha(a)latrappe.fr QAContact: koha-bugs(a)lists.koha-community.org CWE-73: External Control of File Name or Path (see http://cwe.mitre.org/data/definitions/73.html) In C4/Templates.pm, in the function themelanguage, the user language is obtain from a cookie 'KohaOpacLanguage', and use 'as-it' in the path's construction for the template filename. In the next piece of code, $la is 'KohaOpacLanguage' cookie value: > # searches through the themes and languages. First template it find it returns. > # Priority is for getting the theme right. > THEME: > foreach my $th (@themes) { > foreach my $la (@languages) { > if ( -e "$htdocs/$th/$la/modules/$tmpl" ) { > $theme = $th; > $lang = $la; > last THEME; > } > last unless $la =~ /[-_]/; > } > } In opac/opac-main.pl, same: if cookie 'KohaOpacLanguage' exists, it used. Here, the page also used HTTP_ACCEPT_LANGUAGE sanitized with regex. In koha/installer/install.pl and koha/installer/InstallAuth.pm the cookie is also used (but need verification if it used in manner that permit exploit). As the cookie could be forged (user input), and contains any characters, it could embed '../' for path-traversable. The exploitation of this problem is mitigated by the fact that the perl function '-e' seems to be resultant to '\0' inclusion (in order to strip all strings after the variable). Suggestions: - A regex sanitization should be used, or, should used C4::Output::getlanguagecookie function, which take only the first two characters (I will prefer a regex like /^[a-zA-Z]*$/ ) - An unified method should be used: a function somewhere (C4:Templates ?) that return a list of possible languages: - first element: cookie value sanitized (if exist) - next sanitized list of ENV{HTTP_ACCEPT_LANGUAGE} - next 'en' -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.

1 40

[Bug 6116] New: Adding child patron: library not set
by bugzilla-daemon＠bugs.koha-community.org 02 Dec '11

02 Dec '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6116 Bug #: 6116 Summary: Adding child patron: library not set Classification: Unclassified Change sponsored?: --- Product: Koha Version: master Platform: All OS/Version: All Status: NEW Severity: minor Priority: P5 Component: Patrons AssignedTo: kyle.m.hall(a)gmail.com ReportedBy: julian.maurice(a)biblibre.com QAContact: koha-bugs(a)lists.koha-community.org CC: gmcharlt(a)gmail.com When adding a patron who is a child, the default library is not set when defining a guarantor. Coming patch will fix that. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.

1 13

[Bug 5923] New: Authorities list :removing link on Summary
by bugzilla-daemon＠bugs.koha-community.org 02 Dec '11

02 Dec '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5923 Bug #: 5923 Summary: Authorities list :removing link on Summary Classification: Unclassified Change sponsored?: --- Product: Koha Version: rel_3_4 Platform: All OS/Version: All Status: NEW Severity: minor Priority: P5 Component: MARC Authority data support AssignedTo: gmcharlt(a)gmail.com ReportedBy: chris(a)bigballofwax.co.nz QAContact: koha-bugs(a)lists.koha-community.org CC: ian.walls(a)bywatersolutions.com Blocks: 5581 removing the link to authority details on authority List directly from summary And adding a generic link to details -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.

1 7

[Bug 5675] New: Returned items always trigger hold notification
by bugzilla-daemon＠bugs.koha-community.org 02 Dec '11

02 Dec '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5675 Summary: Returned items always trigger hold notification Change sponsored?: --- Product: Koha Version: unspecified Platform: All OS/Version: All Status: NEW Severity: enhancement Priority: P5 Component: Staff Client AssignedTo: paul.poulain(a)biblibre.com ReportedBy: jcamins(a)cpbibliography.com QAContact: koha-bugs(a)lists.koha-community.org CC: gmcharlt(a)gmail.com Estimated Hours: 0.0 It seems that when an item is checked in for a biblio that has a biblio-level hold, the message notifying the librarian that the book is on hold always comes up, even when holds are not allowed on that itemtype. The cause seems to be that returns.pl does not check the circulation rules, just whether or not there is a hold. There should be some sort of sanity testing to confirm that an item really is allowed to have a hold on it. Example: 1. Create a biblio with one item of a type that can have holds on it. 2. Place a hold on that biblio. 3. Create a new item of a type that cannot have a hold. 4. Check in new item. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA contact for the bug.

1 13

[Bug 5975] New: OPAC should use divs/spans with classes for CSS customization
by bugzilla-daemon＠bugs.koha-community.org 02 Dec '11

02 Dec '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5975 Bug #: 5975 Summary: OPAC should use divs/spans with classes for CSS customization Classification: Unclassified Change sponsored?: --- Product: Koha Version: unspecified Platform: All OS/Version: All Status: NEW Severity: enhancement Priority: P5 Component: OPAC AssignedTo: oleonard(a)myacpl.org ReportedBy: jcamins(a)cpbibliography.com QAContact: koha-bugs(a)lists.koha-community.org In order to simplify customizing the OPAC with CSS and jQuery, classes should be added to divs and spans in the OPAC. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.

1 6

[Bug 5973] New: Staff client should use divs/spans with classes for CSS customization
by bugzilla-daemon＠bugs.koha-community.org 02 Dec '11

02 Dec '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5973 Bug #: 5973 Summary: Staff client should use divs/spans with classes for CSS customization Classification: Unclassified Change sponsored?: --- Product: Koha Version: unspecified Platform: All OS/Version: All Status: NEW Severity: enhancement Priority: P5 Component: Staff Client AssignedTo: paul.poulain(a)biblibre.com ReportedBy: jcamins(a)cpbibliography.com QAContact: koha-bugs(a)lists.koha-community.org CC: gmcharlt(a)gmail.com In order to simplify customizing the staff client with CSS and jQuery, classes should be added to divs and spans in the staff client. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.

1 5

[Bug 6519] New: Analytic links should use ti,phr
by bugzilla-daemon＠bugs.koha-community.org 02 Dec '11

02 Dec '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6519 Bug #: 6519 Summary: Analytic links should use ti,phr Classification: Unclassified Change sponsored?: --- Product: Koha Version: rel_3_6 Platform: All OS/Version: All Status: NEW Severity: enhancement Priority: P5 Component: OPAC AssignedTo: jcamins(a)cpbibliography.com ReportedBy: jcamins(a)cpbibliography.com QAContact: koha-bugs(a)lists.koha-community.org Analytic links in the OPAC and Staff client should use ti,phr: for title-based searching rather than Title:, in order to reduce the number of false positives. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.

1 11

[Bug 6303] New: Display Organisation and Parent Organisation names when viewing a borrower of type organistaion
by bugzilla-daemon＠bugs.koha-community.org 30 Nov '11

30 Nov '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6303 Bug #: 6303 Summary: Display Organisation and Parent Organisation names when viewing a borrower of type organistaion Classification: Unclassified Change sponsored?: --- Product: Koha Version: rel_3_6 Platform: All OS/Version: All Status: NEW Severity: enhancement Priority: P5 Component: Patrons AssignedTo: kyle.m.hall(a)gmail.com ReportedBy: srdjan(a)catalyst.net.nz QAContact: koha-bugs(a)lists.koha-community.org CC: gmcharlt(a)gmail.com Display in ‘member details & OPAC Org & Parent org names eg Room 1, Paeroa Central School – otherwise room 1 is meaningless -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.

1 31

[Bug 6414] New: actual price not recorded when ordering
by bugzilla-daemon＠bugs.koha-community.org 29 Nov '11

29 Nov '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6414 Bug #: 6414 Summary: actual price not recorded when ordering Classification: Unclassified Change sponsored?: --- Product: Koha Version: master Platform: All OS/Version: All Status: NEW Severity: major Priority: P5 Component: Acquisitions AssignedTo: henridamien(a)koha-fr.org ReportedBy: nengard(a)gmail.com QAContact: koha-bugs(a)lists.koha-community.org When you enter an actual price at the time of placing an order (adding to a basket) it gets ignored by the db (http://screencast.com/t/7Py5tFyjl6c4) It's not until you receive that that field is populated in the database (http://screencast.com/t/XEtPeYIq) Given that one of two things needs to happen. 1. Remove actual price from the order form and only have it on receive 2. Leave actual price on the order form and populate the database with the values entered in the form. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.

1 9