November 2017 - Koha-bugs - lists.koha-community.org

[Bug 19125] XSS - members.pl
by bugzilla-daemon＠bugs.koha-community.org 23 Nov '17

23 Nov '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=19125 Mason James <mtj(a)kohaaloha.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mtj(a)kohaaloha.com --- Comment #9 from Mason James <mtj(a)kohaaloha.com> --- Pushed to 16.05.x, for 16.05.17 release -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 19108] Stored XSS in multiple scripts
by bugzilla-daemon＠bugs.koha-community.org 23 Nov '17

23 Nov '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=19108 Mason James <mtj(a)kohaaloha.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mtj(a)kohaaloha.com --- Comment #27 from Mason James <mtj(a)kohaaloha.com> --- Pushed to 16.05.x, for 16.05.17 release -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 19103] Stored XSS in itemtypes.pl - patron-attr-types.pl - matching-rules.pl
by bugzilla-daemon＠bugs.koha-community.org 23 Nov '17

23 Nov '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=19103 Mason James <mtj(a)kohaaloha.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mtj(a)kohaaloha.com --- Comment #14 from Mason James <mtj(a)kohaaloha.com> --- Pushed to 16.05.x, for 16.05.17 release -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 19086] Multiple cross-site scripting vulnerabilities
by bugzilla-daemon＠bugs.koha-community.org 23 Nov '17

23 Nov '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=19086 --- Comment #44 from Mason James <mtj(a)kohaaloha.com> --- Pushed to 16.05.x, for 16.05.17 release -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0

[Bug 18654] New: Translatability: Get rid of tt directives starting with [ %% in translation for itemsearch.tt
by bugzilla-daemon＠bugs.koha-community.org 23 Nov '17

23 Nov '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18654 Bug ID: 18654 Summary: Translatability: Get rid of tt directives starting with [%% in translation for itemsearch.tt Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: I18N/L10N Assignee: koha-bugs(a)lists.koha-community.org Reporter: veron(a)veron.ch QA Contact: testopia(a)bugs.koha-community.org CC: frederic(a)tamil.fr Translation for file itemsearch.tt exposes tt directifes like: %s %s %s %s %s %s %s %s %s [%% params = { f => f.$i q = q.$i op = op.$i } %%] %s %s %s %s %s %s %s %s %s %s %s or [%% INCLUDE form_field_select name="homebranch" options = branches empty_option = "All libraries" %%] [%% INCLUDE form_field_select name="holdingbranch" options = branches empty_option = "All libraries" %%] %s [%% INCLUDE form_field_select name="location" options = locations empty_option = "All locations" %%] %s -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 31

[Bug 18906] New: Superlibrarian and budget_manage_all users should always see all funds
by bugzilla-daemon＠bugs.koha-community.org 23 Nov '17

23 Nov '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18906 Bug ID: 18906 Summary: Superlibrarian and budget_manage_all users should always see all funds Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Acquisitions Assignee: koha-bugs(a)lists.koha-community.org Reporter: katrin.fischer(a)bsz-bw.de QA Contact: testopia(a)bugs.koha-community.org If you have the superlibrarian or budget_manage_all permission you should be able to see all funds at all times - otherwise it's not possible to centrally manage and edit funds in a multi-branch system. Also, if someone logged themselves out from a fund by wrong configuration, users with those permissions need to be able to fix it. To test: - Make sure your user has superlibrarian permission - Go into acquisisitions - Create a new budget - Create a new fund - set library to 'not your home library' - set restricted to 'owner, users and library' - Verify that after saving the fund, you can no longer access it. - Change your home branch - log out and log in again - Verify you can now see the fund Repeat with all acq permissions including budget_manage_all - you will also experience that you are logged out from accessing the fund you created. Note: visibility on the acq start page will work correctly in these scenarios. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 12

[Bug 18898] New: Some permissions for Reports can be bypassed
by bugzilla-daemon＠bugs.koha-community.org 23 Nov '17

23 Nov '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18898 Bug ID: 18898 Summary: Some permissions for Reports can be bypassed Change sponsored?: --- Product: Koha Version: 16.11 Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Reports Assignee: koha-bugs(a)lists.koha-community.org Reporter: bovinitydivinity(a)comcast.net QA Contact: testopia(a)bugs.koha-community.org In 16.11.05.000 If a user has permissions to run - but not create or edit reports - they can still create or edit reports by editing the the URL while running a report and changing the Phase parameter to "Edit SQL" or "Create report from SQL". -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 15

[Bug 17827] New: Untranslatable "by" in MARC21slim2intranetResults.xsl
by bugzilla-daemon＠bugs.koha-community.org 23 Nov '17

23 Nov '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17827 Bug ID: 17827 Summary: Untranslatable "by" in MARC21slim2intranetResults.xsl Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: I18N/L10N Assignee: koha-bugs(a)lists.koha-community.org Reporter: dubyk(a)ukr.net QA Contact: testopia(a)bugs.koha-community.org CC: frederic(a)tamil.fr Created attachment 58490 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=58490&action=ed… patch Not translated "by" before the authors in the search results window in staff interface (MARC21). In attachment patch for MARC21slim2intranetResults.xsl -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 20

[Bug 18778] New: Translatability: Get rid of tt directive in translation for item-status.inc
by bugzilla-daemon＠bugs.koha-community.org 23 Nov '17

23 Nov '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18778 Bug ID: 18778 Summary: Translatability: Get rid of tt directive in translation for item-status.inc Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: trivial Priority: P5 - low Component: I18N/L10N Assignee: koha-bugs(a)lists.koha-community.org Reporter: veron(a)veron.ch QA Contact: testopia(a)bugs.koha-community.org CC: frederic(a)tamil.fr The file opac-tmpl/bootstrap/en/includes/item-status.inc exposes a template directive where translators should not be confronted with. "%s %s [%%#- This include takes two parameters: an item structure and an " "optional loan (issue) structure. The issue structure is used by course " "reserves pages, which do not use an API to fetch items that populates item." "datedue. -%%] %s %s %s %s " -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 10

[Bug 18660] New: Translatability: Get rid of template directives [ %% in translation for patroncards-errors.inc
by bugzilla-daemon＠bugs.koha-community.org 23 Nov '17

23 Nov '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18660 Bug ID: 18660 Summary: Translatability: Get rid of template directives [%% in translation for patroncards-errors.inc Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: trivial Priority: P5 - low Component: I18N/L10N Assignee: koha-bugs(a)lists.koha-community.org Reporter: veron(a)veron.ch QA Contact: testopia(a)bugs.koha-community.org CC: frederic(a)tamil.fr Translation for koha-tmpl/intranet-tmpl/prog/en/includes/patroncards-errors.inc contains a lot of (partial) template directives like %%]%s %sLayout: [%% -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 18