October 2012 - Koha-bugs - lists.koha-community.org

[Bug 1963] Problem with deleted biblio in a virtual shelf
by bugzilla-daemon＠bugs.koha-community.org 17 Oct '12

17 Oct '12

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=1963 Paul Poulain <paul.poulain(a)biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master Version|master |rel_3_10 --- Comment #13 from Paul Poulain <paul.poulain(a)biblibre.com> --- Patch pushed to master -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 5356] New: Shipping billing addess improvements
by bugzilla-daemon＠bugs.koha-community.org 17 Oct '12

17 Oct '12

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5356 Summary: Shipping billing addess improvements Change sponsored?: Sponsored Product: Koha Version: rel_3_4 Platform: All URL: http://wiki.koha-community.org/wiki/Shipping_billing_a cq_RFC OS/Version: All Status: NEW Severity: enhancement Priority: P5 Component: Acquisitions AssignedTo: henridamien(a)koha-fr.org ReportedBy: paul.poulain(a)biblibre.com QAContact: koha-bugs(a)lists.koha-community.org Estimated Hours: 0.0 Deadline: 2011-05-01 The library will be able to choose shipping and billing address at basket level. If those informations are filled at basket address, then they won't have to be filled at basketgroup. If shipping & billing addresses are filled at basket level, the information will be stored in the comment section of the basket. That will be usefull for libraries having a single basketgroup for the supplier, but different shipping/billing address -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA contact for the bug.

1 56

[Bug 3652] XSS vulnerabilities
by bugzilla-daemon＠bugs.koha-community.org 17 Oct '12

17 Oct '12

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3652 --- Comment #39 from Jared Camins-Esakov <jcamins(a)cpbibliography.com> --- (In reply to comment #38) > Comment on attachment 12835 [details] > Bug 3652: close XSS vulnerabilities on biblionumber and authid > > About this patch, Jared, why do you add > || $query->param('bib'); > to opac-ISBD|MARCdetail.pl ? > I see it's in opac-detail, but it's an oldies and not goodies (in early > versions of Koha, biblionumber was sometimes written bib, bn, ... It has > been fixed, and I favour removing > || $query->param('bib'); > from opac-detail.pl, because we must not have param('bib') I wanted to make sure the behavior was identical, and I figured there must surely be a good reason for the $query->param('bib'). If you wanted to remove the || $query->param('bib') from all three files, I would not object at all. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 3652] XSS vulnerabilities
by bugzilla-daemon＠bugs.koha-community.org 17 Oct '12

17 Oct '12

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3652 --- Comment #38 from Paul Poulain <paul.poulain(a)biblibre.com> --- Comment on attachment 12835 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=12835 Bug 3652: close XSS vulnerabilities on biblionumber and authid About this patch, Jared, why do you add || $query->param('bib'); to opac-ISBD|MARCdetail.pl ? I see it's in opac-detail, but it's an oldies and not goodies (in early versions of Koha, biblionumber was sometimes written bib, bn, ... It has been fixed, and I favour removing || $query->param('bib'); from opac-detail.pl, because we must not have param('bib') -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 3652] XSS vulnerabilities
by bugzilla-daemon＠bugs.koha-community.org 17 Oct '12

17 Oct '12

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3652 Paul Poulain <paul.poulain(a)biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #12809|0 |1 is obsolete| | --- Comment #37 from Paul Poulain <paul.poulain(a)biblibre.com> --- Comment on attachment 12809 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=12809 Bug 3652: [SIGNED-OFF] XSS fixes - follow up QA comment, trivial patch, passes QA & pushed -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 1963] Problem with deleted biblio in a virtual shelf
by bugzilla-daemon＠bugs.koha-community.org 17 Oct '12

17 Oct '12

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=1963 --- Comment #12 from Kyle M Hall <kyle(a)bywatersolutions.com> --- (In reply to comment #11) > I would favor pushing this patch, if we fix the constraint stuff on another > report (including some lines in updatedatabase to correct the historical > "ballast" from MyISAM etc.) > This patches fixes a display problem that theoretically should not occur, > but in practice does. The other report would deal with the wrong data. I tend to agree. This patch may just be 'hiding' the underlying problem, but we are now aware of it. As long as we follow up on this issue with a correction 'under the hood', I see no reason not to push this as a quick fix from the user stand point. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 1963] Problem with deleted biblio in a virtual shelf
by bugzilla-daemon＠bugs.koha-community.org 17 Oct '12

17 Oct '12

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=1963 M. de Rooy <m.de.rooy(a)rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |m.de.rooy(a)rijksmuseum.nl --- Comment #11 from M. de Rooy <m.de.rooy(a)rijksmuseum.nl> --- I would favor pushing this patch, if we fix the constraint stuff on another report (including some lines in updatedatabase to correct the historical "ballast" from MyISAM etc.) This patches fixes a display problem that theoretically should not occur, but in practice does. The other report would deal with the wrong data. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 3652] XSS vulnerabilities
by bugzilla-daemon＠bugs.koha-community.org 17 Oct '12

17 Oct '12

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3652 Chris Hall <chrish(a)catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Needs Signoff Assignee|oleonard(a)myacpl.org |chrish(a)catalyst.net.nz --- Comment #36 from Chris Hall <chrish(a)catalyst.net.nz> --- Created attachment 12876 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=12876&action=edit Fixing XSS vulnerability in opac-search Fixes XSS vulnerabilites in opac-search Search in the opac for ';</script><script>alert(10);</alert>' (without the quotes around it), a pop up should appear. You could also visit /cgi-bin/koha/opac-search.pl?q=%3B%3C%2Fscript%3E%3Cscript%3Ealert%2810%29%3B%3C%2Fscript%3E Notes: The above XSS vuln will work in firefox 16.01 but will not work in chromium 18 as chromium detects that the string is user supplies, instead chromium will report an error message to the console. Arachni still believes that the opac-search is vulnerable despite this fix, I believe it is incorrect as the string it tries to inject is made up of alphanumeric and hyphens, (as far as I know) none of these are dangerous when rendered within a form or script element. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 3684] MARC21 default framework, missing tag
by bugzilla-daemon＠bugs.koha-community.org 17 Oct '12

17 Oct '12

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3684 Chris Cormack <chris(a)bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED CC| |chris(a)bigballofwax.co.nz Resolution|--- |DUPLICATE --- Comment #6 from Chris Cormack <chris(a)bigballofwax.co.nz> --- *** This bug has been marked as a duplicate of bug 5858 *** -- You are receiving this mail because: You are the QA Contact for the bug. You are watching all bug changes.

1 0

[Bug 5499] New: cataloging search populating z search menu
by bugzilla-daemon＠bugs.koha-community.org 17 Oct '12

17 Oct '12

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5499 Summary: cataloging search populating z search menu Change sponsored?: --- Product: Koha Version: HEAD Platform: All OS/Version: All Status: NEW Severity: normal Priority: P5 Component: Cataloging AssignedTo: gmcharlt(a)gmail.com ReportedBy: nengard(a)gmail.com QAContact: koha-bugs(a)lists.koha-community.org CC: ian.walls(a)bywatersolutions.com Estimated Hours: 0.0 The only way to explain this is to give you the steps to follow o go to more >Cataloging o search in the cataloging search for something that won’t be found o you get no results o you click ‘z39.50 search’ to try to find it that way o note that the title field is populated with your search from the previous page o this is a nuisance and not a feature like it was maybe originally intended -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA contact for the bug.

1 1