August 2011 - Koha-bugs - lists.koha-community.org

[Bug 6642] New: Able to download label batches as an unauthorized user
by bugzilla-daemon＠bugs.koha-community.org 04 Aug '11

04 Aug '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6642 Bug #: 6642 Summary: Able to download label batches as an unauthorized user Classification: Unclassified Change sponsored?: --- Product: Koha Version: rel_3_6 Platform: All OS/Version: All Status: NEW Severity: major Priority: P5 Component: Label printing AssignedTo: cnighswonger(a)foundations.edu ReportedBy: wizzyrea(a)gmail.com QAContact: koha-bugs(a)lists.koha-community.org http://staff.client.url/cgi-bin/koha/labels/label-create-pdf.pl?batch_id=1&… (as an example) would allow unauthorized users to download generated PDF files from the staff side of the ILS. It might be possible to DOS the staff client using this. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.

1 6

[Bug 4222] Nonpublic note not appearing in the staff client
by bugzilla-daemon＠bugs.koha-community.org 04 Aug '11

04 Aug '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=4222 --- Comment #25 from Paul Poulain <paul.poulain(a)biblibre.com> 2011-08-04 11:25:15 UTC --- Created attachment 4836 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=4836 Script to rebuild items after a mapping change Here is the script we have developed, and, good news, it's generic What it does : * foreach MARC::Record in the biblioitems.marcxml * foreach item located in the MARC::Record * rebuild the item hash & the unlinked_items_subfields * save the item It means this script consider temporarily that what is in the marc::record is authoritative (in Koha, it's what is in items that is authoritative usually) If it helps, this script could be added into misc/maintenance I think The limit of this script : result in a zebra reindexing, so can be quite slow. A good way to circumvent this problem is to suspend the crontabed rebuild_zebra during execution of this script, then full rebuild_zebra.pl, then reactivate it. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.

1 0

[Bug 4222] Nonpublic note not appearing in the staff client
by bugzilla-daemon＠bugs.koha-community.org 04 Aug '11

04 Aug '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=4222 --- Comment #24 from Paul Poulain <paul.poulain(a)biblibre.com> 2011-08-04 08:13:00 UTC --- Well spotted Katrin ! This is a MAJOR problem. We already had it for some of our customers, when he asked for some mapping changes. The result is really annoying, Koha is highly confused by this case. We've made a script. iirc, it was specific to this customer, but maybe it could be adapted easily (and maybe it's not specific) Will investigate ASAP -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.

1 0

[Bug 4222] Nonpublic note not appearing in the staff client
by bugzilla-daemon＠bugs.koha-community.org 04 Aug '11

04 Aug '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=4222 --- Comment #23 from Katrin Fischer <katrin.fischer(a)bsz-bw.de> 2011-08-04 04:41:19 UTC --- I am a bit worried about this patch because when you have not mapped the nonpublicnote to any field, your data is saved into more_subfields_xml. After the frameworks are updated with this patch, you will not be able to access the data. The information will still be stored in the xml field, but your frameworks will be pointing to the new column. I am not sure how to prevent this. Would it be possible to move the data from the XML field into the new subfield on update? What would the risks be? -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.

1 0

[Bug 4222] Nonpublic note not appearing in the staff client
by bugzilla-daemon＠bugs.koha-community.org 04 Aug '11

04 Aug '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=4222 --- Comment #22 from Nicole C. Engard <nengard(a)gmail.com> 2011-08-04 04:11:52 UTC --- Updated patch signed off on. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.

1 0

[Bug 4222] Nonpublic note not appearing in the staff client
by bugzilla-daemon＠bugs.koha-community.org 04 Aug '11

04 Aug '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=4222 Srdjan Jankovic <srdjan(a)catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #4775|0 |1 is obsolete| | --- Comment #21 from Srdjan Jankovic <srdjan(a)catalyst.net.nz> 2011-08-04 02:10:45 UTC --- Created attachment 4832 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=4832 patch Moved the field, added upgrade warning -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.

1 0

[Bug 5131] New: XSS vulnerability in the OPAC search results interface
by bugzilla-daemon＠bugs.koha-community.org 04 Aug '11

04 Aug '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5131 Summary: XSS vulnerability in the OPAC search results interface Change sponsored?: --- Product: Koha Version: HEAD Platform: All OS/Version: All Status: NEW Severity: critical Priority: P5 Component: OPAC AssignedTo: oleonard(a)myacpl.org ReportedBy: robin(a)catalyst.net.nz QAContact: koha-bugs(a)lists.koha-community.org Estimated Hours: 0.0 In opac-search.pl: foreach my $sort (@sort_by) { $template->param($sort => 1); # FIXME: security hole. can set any TMPL_VAR here } This makes it pretty easy for someone to do things like inject arbitrary HTML and Javascript, and so steal the credentials of another user. This operation needs a whitelist of valid values that it checks against. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA contact for the bug.

1 9

[Bug 4222] Nonpublic note not appearing in the staff client
by bugzilla-daemon＠bugs.koha-community.org 03 Aug '11

03 Aug '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=4222 --- Comment #20 from Ian Walls <ian.walls(a)bywatersolutions.com> 2011-08-03 20:16:09 UTC --- Paul, The first issue is purely cosmetic, in my opinion, and should not delay this patch. Srdjan, if you want to alter the database update portion to place this column after "itemnotes", go ahead, but it's not required. For the alteration of the marc_subfield_structure, I think that benefit of automatically inserting this bit of data in order to complete the feature outweighs the slight chance of someone having mapped items to a different MARC field. For safety sake, perhaps an added note to the updatedatabase.pl line saying: "If you have mapped your items to a MARC field other than 952 (system default), please check your Koha to MARC mapping for items.nonpublicnote" Thank you, Paul, for catching this fringe case. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.

1 0

[Bug 5320] New: Estimate optionally next planned date for serials without periodicity
by bugzilla-daemon＠bugs.koha-community.org 03 Aug '11

03 Aug '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5320 Summary: Estimate optionally next planned date for serials without periodicity Change sponsored?: --- Product: Koha Version: rel_3_2 Platform: All OS/Version: All Status: ASSIGNED Severity: enhancement Priority: PATCH-Sent Component: Serials AssignedTo: m.de.rooy(a)rijksmuseum.nl ReportedBy: m.de.rooy(a)rijksmuseum.nl QAContact: koha-bugs(a)lists.koha-community.org Estimated Hours: 0.0 For periodicity Irregular, Unknown or "Without periodicity", it would be helpful if Koha could suggest a next planned date when receiving an issue based on the time interval between the last two receivals of this serial. This option is triggered by new local-use preference SerialEstimatePlannedDate. If this option exists and contains uppercase W for without periodicity, I for irregular or U for unknown, or a combination of those characters, the option is enabled for these particular periodicities. Behavior does not change for other periodicities. Implemented by some small changes in C4/Serials.pm, routine GetNextDate. Patch has been sent. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA contact for the bug.

1 7

[Bug 4518] Enhance 2.2 to 3.0 scripts
by bugzilla-daemon＠bugs.koha-community.org 03 Aug '11

03 Aug '11

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=4518 --- Comment #4 from Chris Cormack <chris(a)bigballofwax.co.nz> 2011-08-03 10:28:42 UTC --- Unfortunately there are hundreds of libraries around the world still running 2.2.x versions. I know of many in malaysia and the philipines. Plus all the windows users. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.

1 0