January 2015 - Koha-bugs - lists.koha-community.org

[Bug 12593] New: search facets die with regex error if biblio has square brackets in fields
by bugzilla-daemon＠bugs.koha-community.org 23 Jan '15

23 Jan '15

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12593 Bug ID: 12593 Summary: search facets die with regex error if biblio has square brackets in fields Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: critical Priority: P5 - low Component: Searching Assignee: gmcharlt(a)gmail.com Reporter: dpavlin(a)rot13.org QA Contact: testopia(a)bugs.koha-community.org It's quite common to have [something] within facet data, and it produces following error: Unmatched [ in regex; marked by <-- HERE in m/^[ <-- HERE Život i običaji narodni ;$/ at /srv/koha//C4/Search.pm line 535. This problem was intoduced in Bug 12151 -- You are receiving this mail because: You are watching all bug changes.

1 22

[Bug 12371] New: Links in every patron self-registration email points to a single borrower
by bugzilla-daemon＠bugs.koha-community.org 23 Jan '15

23 Jan '15

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12371 Bug ID: 12371 Summary: Links in every patron self-registration email points to a single borrower Change sponsored?: --- Product: Koha Version: 3.14 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: barton(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org Library has the following system preferences set for Patron Self Registration: *************************** 1. row *************************** variable: PatronSelfRegistration value: 1 options: NULL explanation: If enabled, patrons will be able to register themselves via the OPAC. type: YesNo *************************** 2. row *************************** variable: PatronSelfRegistrationAdditionalInstructions value: Thank you for registering for a library card.<br> To complete your registration, please come to your library (Cook, Jackson, or Madison) with identification documents, that show: <ul> <li>proof of residency (physical address) </li> <li>mailing address</li> <li>photo ID</li> </ul> <br> We will save your information for 30 days, please stop in soon! options: NULL explanation: A free text field to display additional instructions to newly self registered patrons. type: free *************************** 3. row *************************** variable: PatronSelfRegistrationBorrowerMandatoryField value: surname|firstname|email|phone options: NULL explanation: Choose the mandatory fields for a patron's account, when registering via the OPAC. type: free *************************** 4. row *************************** variable: PatronSelfRegistrationBorrowerUnwantedField value: sex options: NULL explanation: Name the fields you don't want to display when registering a new patron via the OPAC. type: free *************************** 5. row *************************** variable: PatronSelfRegistrationDefaultCategory value: ONLINEREG options: explanation: A patron registered via the OPAC will receive a borrower category code set in this system preference. type: free *************************** 6. row *************************** variable: PatronSelfRegistrationExpireTemporaryAccountsDelay value: 30 options: NULL explanation: If PatronSelfRegistrationDefaultCategory is enabled, this system preference controls how long a patron can have a temporary status before the acc ount is deleted automatically. It is an integer value representing a number of days to wait before deleting a temporary patron account. Setting it to 0 disabl es the deleting of temporary accounts. type: Integer *************************** 7. row *************************** variable: PatronSelfRegistrationVerifyByEmail value: 1 options: NULL explanation: If enabled, any patron attempting to register themselves via the OPAC will be required to verify themselves via email to activate his or her acco unt. type: YesNo --- The self registration email is sent emails contining unique tokens, but all of the tokens are associated with borrowernumber 0: select verification_token, count(verification_token), borrowernumber from borrower_modifications where verification_token is not null group by verification_token; +----------------------------------+---------------------------+----------------+ | verification_token | count(verification_token) | borrowernumber | +----------------------------------+---------------------------+----------------+ | 8748c0cf981f3fadd6ec78433a5beddb | 1 | 0 | | 96738d8a27251326a7eb3971b1a03eb5 | 1 | 0 | | a5de1159d20fd3ed3f4a8d189db3fb32 | 1 | 0 | | aa131a40d93057e676c363a3e11be060 | 1 | 0 | | adf1bbfd6715714e9e8642e38d0c4462 | 1 | 0 | | b28898063358455c350e7eff9dc4cb94 | 1 | 0 | | ba24d496a711aa07f4a20a99c10c6d58 | 1 | 0 | | e035486fb47e2b6f3af641550098f6ea | 1 | 0 | | ec09849390835652149736252010b66e | 1 | 0 | | fdf76c060abb49b2ad1dc7aa2bdea7fb | 1 | 0 | +----------------------------------+---------------------------+----------------+ 10 rows in set (0.00 sec) This means that when a patron clicks on the link to verify their identity, they will all connect to the same patron record. -- You are receiving this mail because: You are watching all bug changes.

1 22

[Bug 12717] New: Library no longer receiving Overdue email for patrons without email address
by bugzilla-daemon＠bugs.koha-community.org 23 Jan '15

23 Jan '15

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12717 Bug ID: 12717 Summary: Library no longer receiving Overdue email for patrons without email address Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Notices Assignee: koha-bugs(a)lists.koha-community.org Reporter: katrin.fischer(a)bsz-bw.de QA Contact: testopia(a)bugs.koha-community.org With bug 10832 the handling of overdue emails has changes. Now if a patron has no email address, there is a 'print' message generated. Before MTT was pushed overdues for patrons without email addresses would automatically be sent to the library as an attachement to an email and could be printed from there. I don't see how this can be done now, but I might be missing a configuration option. Right now it looks like a regression for libraries not using server generated files. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 29

[Bug 12619] New: Shipment cost gets lost on finishing the invoice
by bugzilla-daemon＠bugs.koha-community.org 23 Jan '15

23 Jan '15

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12619 Bug ID: 12619 Summary: Shipment cost gets lost on finishing the invoice Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Acquisitions Assignee: koha-bugs(a)lists.koha-community.org Reporter: katrin.fischer(a)bsz-bw.de QA Contact: testopia(a)bugs.koha-community.org to reproduce: - Create a new shipment, make sure to add a shipment date - Receive or not receive orders - Finish receiving with the button at the bottom of the page - Verify that shipment date is now empty -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 14

[Bug 11341] New: XSS attack vendor in facets in OPAC - prog theme
by bugzilla-daemon＠bugs.koha-community.org 23 Jan '15

23 Jan '15

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11341 Bug ID: 11341 Summary: XSS attack vendor in facets in OPAC - prog theme Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: critical Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: chris(a)bigballofwax.co.nz QA Contact: testopia(a)bugs.koha-community.org If you craft some html in the offset variable, you can create an xss attack in the show more link in the facets. Patch to follow -- You are receiving this mail because: You are watching all bug changes.

1 12

[Bug 13425] There is an xss vulnerability in 3.16, 3.18 and master in the opac and intranet facets
by bugzilla-daemon＠bugs.koha-community.org 23 Jan '15

23 Jan '15

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13425 Jonathan Druart <jonathan.druart(a)biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |http://bugs.koha-community. | |org/bugzilla3/show_bug.cgi? | |id=13618 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 13510] Cross site scripting in opac lists
by bugzilla-daemon＠bugs.koha-community.org 23 Jan '15

23 Jan '15

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13510 Jonathan Druart <jonathan.druart(a)biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |http://bugs.koha-community. | |org/bugzilla3/show_bug.cgi? | |id=13618 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 13510] Cross site scripting in opac lists
by bugzilla-daemon＠bugs.koha-community.org 23 Jan '15

23 Jan '15

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13510 Fridolin SOMERS <fridolyn.somers(a)biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolyn.somers(a)biblibre.co | |m --- Comment #20 from Fridolin SOMERS <fridolyn.somers(a)biblibre.com> --- Pushed to 3.14.x will be in 3.14.13 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 13510] Cross site scripting in opac lists
by bugzilla-daemon＠bugs.koha-community.org 23 Jan '15

23 Jan '15

1 0

[Bug 13615] New: callnumber.pl when editing existing 942h or 952o adds a space and digit
by bugzilla-daemon＠bugs.koha-community.org 23 Jan '15

23 Jan '15

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13615 Bug ID: 13615 Summary: callnumber.pl when editing existing 942h or 952o adds a space and digit Change sponsored?: --- Product: Koha Version: 3.18 Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Cataloging Assignee: gmcharlt(a)gmail.com Reporter: eb(a)efdss.org QA Contact: testopia(a)bugs.koha-community.org CC: m.de.rooy(a)rijksmuseum.nl Disclaimer: I'm not certain I understand what callnumber.pl should do. I have been experimenting with enabling it in 942h to pull the callnumber from our 099 field (it doesn't) and / or in 952o to do the same thing (it does if the plugin is not enabled in the 942). If I enable it only in the 942h, it will automatically populate the 952o using what's entered in the 942h. That in itself seems counter-intuitive. Note: our call numbers are not unique. I don't know how this relates to bug 13364, or if there is an underlying assumption that a field with callnumber.pl enabled will be unique. When editing a catalogue record, we manually type in the contents of the 942$h (call number). When editing this field in a reopened record, after hitting save, a space and numeral 1 magically appear following the call number, completely without our input. Here it is in a record - the call number should be only "QM" as it is in the 099 field. It appears to be adding 0001 in the 942 $6 which we have set to ignore. If the 1 is successfully deleted from the $h, the 0001 also vanishes from $6. 000 00720ndm a22002057a 4500 001 201501211025.nw 003 UkLoVW 005 20150121224121.0 008 150121q1926 enkfmle nn 0 eng d 040 _aUkLoVW_beng_cUkLoVW 099 _aQM 100 1 _913719_aHooton, P. M. 245 10 _aManuscript music book / 300 _a6 p. :_bmusic ;_c30 cm. 500 _aManuscript music book with country morris and sword dance tunes, including bass parts in some cases. The name P. M. Hooton is on the front cover, probably Miss P. M. Hooton of Norwich who was an EFDS member in the 1920s. 650 7 _9127_aDance music 650 7 _9163_aEngland 850 _aUkLoVW 942 _2VWML_cMS_hQM 1_n0_6QM0001 999 _c65844_d65844 Other tests I've run: The following things happen only after I edit the field in question. With the plugin callnumber.pl activated in both 942h and 952$o : the 1 appears after the call number in 942h as described above. But, it vanishes again without being deleted manually - it does not appear in the MARC after saving. The 952$o is populated automatically with the information from 942 h. With the plugin enabled in 942h, if I click on the box to the right of the 942h (this is only visible when the plugin is activated) - it inserts the 1. If I disable the plugin in 942 and enable it in 952, it will pull the information directly from the 099 field to 952o. But if you edit an existing item's 952o, it adds the 1. If there is an item attached to the same biblio that has the 1 already inserted, a subsequently edited item will add a 2. I haven't gone further than that, but it appears to be keeping track and incrementally changing the number it inserts. The problem was reported by staff using Windows and Chrome. I have replicated it on Mac OSX using Chrome and Firefox. -- You are receiving this mail because: You are watching all bug changes.

1 1