March 2016 - Koha-bugs - lists.koha-community.org

[Bug 11590] Restrict the actions for the DB user
by bugzilla-daemon＠bugs.koha-community.org 08 Mar '16

08 Mar '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11590 Blou <philippe.blouin(a)inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |In Discussion --- Comment #13 from Blou <philippe.blouin(a)inlibro.com> --- The patch does what I need, but would need two more things, I think: 1) Make that a preference. To make it more acceptable to the people who don't believe in security :) 1b) The preference should by default be ON, but hey, that's arguable. 2) Prevent the unlimited creation of superuser using that user. I think as soon as there's one in the DB, the creation should be blocked. After that, an access directly to the db is required if you forget your account. Otherwise, the door is as open as before. 2b) I got a bash script to create support accounts from the backend. I'd be happy to add it to a patch if wanted. I'll sign the first patch off, because I think it's already a great move ahead. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0

[Bug 11998] Syspref caching issues
by bugzilla-daemon＠bugs.koha-community.org 08 Mar '16

08 Mar '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11998 --- Comment #125 from Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> --- Hi Jacek, Did you try to profile a "real life" situation? I think it would make sense to use NYTProf on different pages, with bug 15973 and bug 15970 (if needed) applied. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 11590] Restrict the actions for the DB user
by bugzilla-daemon＠bugs.koha-community.org 08 Mar '16

08 Mar '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11590 Blou <philippe.blouin(a)inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #40963|1 |0 is obsolete| | --- Comment #12 from Blou <philippe.blouin(a)inlibro.com> --- Comment on attachment 40963 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=40963 Bug 11590: Restrict the actions for the DB user I'd like to test this. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0

[Bug 11590] Restrict the actions for the DB user
by bugzilla-daemon＠bugs.koha-community.org 08 Mar '16

08 Mar '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11590 Blou <philippe.blouin(a)inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |philippe.blouin(a)inlibro.com --- Comment #11 from Blou <philippe.blouin(a)inlibro.com> --- I'd like to reply on Robin's comment. Here, I see a serious need for this as a matter of managing security. Let just call that the disgruntled employee scenario. I have no need for it RIGHT NOW, but as we plan for every possible outcome, to safeguard our customer's data or maintaining 24/7 access, one of them is the I-QUIT-AND-DESTROY-ALL-YOUR-SH.. scenario. So OK, I have my you-quit-I-lock-out-your-account. But changing a database password is a pain, always with some unforeseen consequences (yeah, I should plan those too). You try to not have to do it. Life is just simpler that way... Also, that's very hard to automate, or do manually through 100 databases. SO, why give a user through a very easy to use UI, very easy to remember staff url, an Uber-Access to all that is sacred in our business ? Anyway, too long text. We can argue about my failures as a security manager, but I reserve the right to argue that this direct access to the system should be blockable. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0

[Bug 14969] Remove C4::Dates from serials/*.pl files
by bugzilla-daemon＠bugs.koha-community.org 08 Mar '16

08 Mar '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14969 --- Comment #41 from Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> --- (In reply to Dobrica Pavlinusic from comment #40) > Is there reason why we use > > output_pref( { dt => dt_from_string( $subs->{startdate} ), dateonly => 1 > } ); > > instead of > > output_pref( { str => subs->{startdate}, dateonly => 1 } ); > > Second one has nice side-effect that it supports empty dates (which return > as undef from database) in serial module. In our case, empty dates for > planneddate and publisheddate produce application error base hash > > { dt => dt_from_string( $line->{planneddate} ), dateonly => 1 } > > folds to > > { dt , dateonly => 1 } > > which makes dt = 'dateonly' which in turn is not object and result in > application error. > > Should I prepare separate bug for this change? Does it make sense? Dobrica, The removal of C4::Dates was quite long, and bug 15166 (which introduced the str param) has been done during this process. Of course we should remove *all* occurrences of output_pref({dt = dt_from_string}); as it is dangerous. It's on my todo list, I just need some motivation... Please open the bug report and assign it to me, maybe it will bring me some energy to do it :) -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14969] Remove C4::Dates from serials/*.pl files
by bugzilla-daemon＠bugs.koha-community.org 08 Mar '16

08 Mar '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14969 --- Comment #40 from Dobrica Pavlinusic <dpavlin(a)rot13.org> --- Is there reason why we use output_pref( { dt => dt_from_string( $subs->{startdate} ), dateonly => 1 } ); instead of output_pref( { str => subs->{startdate}, dateonly => 1 } ); Second one has nice side-effect that it supports empty dates (which return as undef from database) in serial module. In our case, empty dates for planneddate and publisheddate produce application error base hash { dt => dt_from_string( $line->{planneddate} ), dateonly => 1 } folds to { dt , dateonly => 1 } which makes dt = 'dateonly' which in turn is not object and result in application error. Should I prepare separate bug for this change? Does it make sense? -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14969] Remove C4::Dates from serials/*.pl files
by bugzilla-daemon＠bugs.koha-community.org 08 Mar '16

08 Mar '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14969 Dobrica Pavlinusic <dpavlin(a)rot13.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dpavlin(a)rot13.org --- Comment #39 from Dobrica Pavlinusic <dpavlin(a)rot13.org> --- Is there reason -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14577] Allow restriction of checkouts based on fines of guarantor/guarantee
by bugzilla-daemon＠bugs.koha-community.org 08 Mar '16

08 Mar '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14577 Nicole C. Engard <nengard(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #48759|0 |1 is obsolete| | --- Comment #6 from Nicole C. Engard <nengard(a)gmail.com> --- Created attachment 48784 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=48784&action=ed… Bug 14577 - Allow restriction of checkouts based on fines of guarantor's guarantees This enhancment allows a library to prevent patrons from checking out items if his or her guarantees own too much. Test Plan: 1) Apply this patch 2) Find or create a patron with a guarantor 3) Add a fine to the patron's account 4) Set the new system preference NoIssuesChargeGuarantees to be less than the amount owed by the patron 4) Attempt to check out an item to the guarantor, you will either be warned or prevented from checking out based on your system settings. Signed-off-by: Cathi Wiggin <CWIGGINS(a)arcadiaca.gov> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14577] Allow restriction of checkouts based on fines of guarantor/guarantee
by bugzilla-daemon＠bugs.koha-community.org 08 Mar '16

08 Mar '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14577 Nicole C. Engard <nengard(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Patch doesn't apply |Signed Off -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 15084] Move the currency related code to Koha::Acquisition::Currenc[y|ies]
by bugzilla-daemon＠bugs.koha-community.org 08 Mar '16

08 Mar '16

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15084 --- Comment #56 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- Created attachment 48783 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=48783&action=ed… Bug 15084: [QA Follow-up] Update kohastructure Adds two db revs to kohastructure -- You are receiving this mail because: You are watching all bug changes.

1 0