October 2017 - Koha-bugs - lists.koha-community.org

[Bug 19333] XSS vulnerability in opac-shelves
by bugzilla-daemon＠bugs.koha-community.org 27 Oct '17

27 Oct '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=19333 Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Component|Koha |Architecture, internals, | |and plumbing Product|Koha security |Koha Group|Koha security | Status|Passed QA |Pushed to Master --- Comment #8 from Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> --- Pushed to master for 17.11, thanks to everybody involved! -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 19117] paycollect.pl is vulnerable for CSRF attacks
by bugzilla-daemon＠bugs.koha-community.org 27 Oct '17

27 Oct '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=19117 Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Product|Koha security |Koha Group|Koha security | Status|Passed QA |Pushed to Master Component|Koha |Architecture, internals, | |and plumbing --- Comment #9 from Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> --- Pushed to master for 17.11, thanks to everybody involved! -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 18956] Possible privacy breach with OPAC password recovery
by bugzilla-daemon＠bugs.koha-community.org 27 Oct '17

27 Oct '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18956 Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master Product|Koha security |Koha Group|Koha security | Component|Koha |Architecture, internals, | |and plumbing --- Comment #25 from Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> --- Pushed to master for 17.11, thanks to everybody involved! -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 9031] Overdue items crossing DST boundary throw invalid local time exception
by bugzilla-daemon＠bugs.koha-community.org 27 Oct '17

27 Oct '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9031 Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master --- Comment #26 from Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> --- Pushed to master for 17.11, thanks to everybody involved! -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 2093] Add OPAC dashboard for logged-in users
by bugzilla-daemon＠bugs.koha-community.org 27 Oct '17

27 Oct '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=2093 Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master --- Comment #23 from Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> --- Pushed to master for 17.11, thanks to everybody involved! -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 19531] New: Can no longer edit patrons with borrower permissions
by bugzilla-daemon＠bugs.koha-community.org 27 Oct '17

27 Oct '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=19531 Bug ID: 19531 Summary: Can no longer edit patrons with borrower permissions Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: blocker Priority: P5 - low Component: Patrons Assignee: koha-bugs(a)lists.koha-community.org Reporter: katrin.fischer(a)bsz-bw.de QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com This was just reported for 16.11.10, but was able to confirm in master: 1) create a staff account with catalog and borrowers permission 2) create a new user with this patron account 3) try to edit the patron account - you get a log in screen (Error: You do not have permission to access this page.) -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 10

[Bug 19528] New: Fixing a few typos like corrosponding
by bugzilla-daemon＠bugs.koha-community.org 27 Oct '17

27 Oct '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=19528 Bug ID: 19528 Summary: Fixing a few typos like corrosponding Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: m.de.rooy(a)rijksmuseum.nl QA Contact: testopia(a)bugs.koha-community.org -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 10

[Bug 19493] New: Remove two warnings from circulation.pl
by bugzilla-daemon＠bugs.koha-community.org 27 Oct '17

27 Oct '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=19493 Bug ID: 19493 Summary: Remove two warnings from circulation.pl Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: m.de.rooy(a)rijksmuseum.nl QA Contact: testopia(a)bugs.koha-community.org If you click Submit on the staff home page without entering a cardnumber, you will find these warnings in the log: Problem = a value of override_high_holds has been passed to param without key at /usr/share/koha/masterclone/C4/Templates.pm line 137. Problem = a value of nopermission has been passed to param without key at /usr/share/koha/masterclone/C4/Templates.pm line 137. Use of uninitialized value $val in concatenation (.) or string at /usr/share/koha/masterclone/C4/Templates.pm line 137. Problem = a value of has been passed to param without key at /usr/share/koha/masterclone/C4/Templates.pm line 137. Cause is this call to $template->param: $template->param( CircAutocompl => C4::Context->preference("CircAutocompl"), debarments => GetDebarments({ borrowernumber => $borrowernumber }), todaysdate => output_pref( { dt => dt_from_string()->set(hour => 23)->set(minute => 59), dateformat => 'sql' } ), has_modifications => $has_modifications, override_high_holds => $override_high_holds, nopermission => scalar $query->param('nopermission'), In this specific case GetDebarments returns undef in list context (empty list), so all items in the list shift one place. Either we should force GetDebarments to return []; or we force scalar context in a construction like this. Note: The calls in memberentry.pl and moremember.pl are not affected. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 10

[Bug 19484] New: Checkout page does not like itemtype NULL
by bugzilla-daemon＠bugs.koha-community.org 27 Oct '17

27 Oct '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=19484 Bug ID: 19484 Summary: Checkout page does not like itemtype NULL Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: m.de.rooy(a)rijksmuseum.nl QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com Somehow an imported item had no itemtype (might be another bug btw), but anyway it results in a never ending loading of checkouts since svc/checkouts crashes. Resolved by a simple test. item-level_itypes set but no itemtype set for item (451) at /usr/share/koha/masterclone/Koha/Schema/Result/Item.pm line 698. Can't call method "translated_description" on an undefined value at /usr/share/koha/masterclone/svc/checkouts line 168. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 14

[Bug 19389] New: Don' t offer search option for libary groups when no groups are defined
by bugzilla-daemon＠bugs.koha-community.org 27 Oct '17

27 Oct '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=19389 Bug ID: 19389 Summary: Don't offer search option for libary groups when no groups are defined Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Searching Assignee: koha-bugs(a)lists.koha-community.org Reporter: katrin.fischer(a)bsz-bw.de QA Contact: testopia(a)bugs.koha-community.org The intranet advanced search page offers to search for groups of libraries, even if the pull down is empty as no library groups have been defined. It would be nicer to hide this search option when no groups are defined. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 9