April 2017 - Koha-bugs - lists.koha-community.org

[Bug 14731] Sip2 unavailable Patron Attributes
by bugzilla-daemon＠bugs.koha-community.org 20 Apr '17

20 Apr '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14731 Magnus Enger <magnus(a)libriotech.no> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |magnus(a)libriotech.no --- Comment #3 from Magnus Enger <magnus(a)libriotech.no> --- (In reply to Jonathan Druart from comment #2) > Duplicate of bug 16694? I don't think so. 16694 is more about making it possible to add an extended patron attribute with values Yes/No, and making the patron's access to certain things depend on that value. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0

[Bug 10756] Carousel Display of New Titles on OPAC home page
by bugzilla-daemon＠bugs.koha-community.org 20 Apr '17

20 Apr '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10756 Suzanne Fayle <sfayle(a)roseman.edu> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |sfayle(a)roseman.edu -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14731] Sip2 unavailable Patron Attributes
by bugzilla-daemon＠bugs.koha-community.org 20 Apr '17

20 Apr '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14731 Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart(a)bugs.koha-c | |ommunity.org See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=16694 --- Comment #2 from Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> --- Duplicate of bug 16694? -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 12063] Change date calculation for reserve expiration to skip all holidays
by bugzilla-daemon＠bugs.koha-community.org 20 Apr '17

20 Apr '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12063 --- Comment #67 from Alex Arnaud <alex.arnaud(a)biblibre.com> --- Created attachment 62474 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=62474&action=ed… Bug 12063 - make perl atomic update follow skeleton.perl -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 7550] Self checkout: limit display of patron image to logged-in patron
by bugzilla-daemon＠bugs.koha-community.org 20 Apr '17

20 Apr '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7550 --- Comment #26 from Marc Véron <veron(a)veron.ch> --- (In reply to Marcel de Rooy from comment #24) > (In reply to Marc Véron from comment #14) > > Hmm, my patch worked with a hash generated with the image file (as > > recommended in comment #7), and it did not leave a security hole with > > SelfCheckoutByLogin="barcode" > > Looks to me that this option is a security hole on itself? > If I guess barcodes, I can still see all images? If I come on sco-main, I > will automatically get the image from the img tag as well? Or do I > misunderstand the discussion here? We have two situations: Situation # 1 - SCO is up and running. A user logs in with what ever credentioals necessary, depending on SelfCheckoutByLogin - User copies the image link into the address bar of a new browser window. It is something like: .../cgi-bin/koha/sco/sco-patron-image.pl?borrowernumber=XXXX - User changes the borrowernumber - Image of an other user is displayed (should not be possible) That's what this bug is about. Problem is solved by adding an unguessable token to the link. Problem #2 - SCO is up and running. SelfCheckOut is set to barcode (i.e. card number) - Someboy comes along the SCO station and tries to log in by guessing card numbers. If the numbering pattern is simple, there is a good chance that they can break in. That's what this bug is not about. IMO problem #2 should be discussed and addressed in a new bug. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 7550] Self checkout: limit display of patron image to logged-in patron
by bugzilla-daemon＠bugs.koha-community.org 20 Apr '17

20 Apr '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7550 --- Comment #25 from Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> --- (In reply to Marcel de Rooy from comment #24) > (In reply to Marc Véron from comment #14) > > Hmm, my patch worked with a hash generated with the image file (as > > recommended in comment #7), and it did not leave a security hole with > > SelfCheckoutByLogin="barcode" > > Looks to me that this option is a security hole on itself? > If I guess barcodes, I can still see all images? If I come on sco-main, I > will automatically get the image from the img tag as well? Or do I > misunderstand the discussion here? The commit message says everything: """ With this patch if SelfCheckoutByLogin is set to 'username and password', only the logged in user will be able to see the image linked to his/her logged in account. If set to "barcode" we generate a token but it can be easily generated. You should add a warning in the about page if SelfCheckoutByLogin="barcode" and ShowPatronImageInWebBasedSelfCheck="Show". """ -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 15352] a way not to show the full url in the holdings
by bugzilla-daemon＠bugs.koha-community.org 20 Apr '17

20 Apr '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15352 Owen Leonard <oleonard(a)myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #62347|0 |1 is obsolete| | --- Comment #3 from Owen Leonard <oleonard(a)myacpl.org> --- Created attachment 62473 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=62473&action=ed… [SIGNED-OFF] Bug 15352: Add syspref URLLinkTextItems, defines text to display for URL URLLinkTextItems replaces the URL of an item on catalog detail pages with this placeholder. To test: 1) Apply patch and update database 2) Edit an item (not a record) and add a URL (field u) 3) Notice the detail page shows the full URL in staff client and OPAC. If this is a very long URL it looks really ugly 4) Go to Admin -> Search for URLLinkTextItems syspref 5) Type something in the textbox (eg: "This is a link") 6) Refresh the detail pages for the record on staff client and OPAC. Confirm the text you entered has replaced the URL text. 7) Confirm the link still redirects you as expected. Sponsored-by: Catalyst IT Signed-off-by: Owen Leonard <oleonard(a)myacpl.org> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 15352] a way not to show the full url in the holdings
by bugzilla-daemon＠bugs.koha-community.org 20 Apr '17

20 Apr '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15352 Owen Leonard <oleonard(a)myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 18275] opac-memberentry.pl security vulnerabilities
by bugzilla-daemon＠bugs.koha-community.org 20 Apr '17

20 Apr '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18275 Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |18442 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18442 [Bug 18442] Permission error when logging into staff interface as db user -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 7550] Self checkout: limit display of patron image to logged-in patron
by bugzilla-daemon＠bugs.koha-community.org 20 Apr '17

20 Apr '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7550 --- Comment #24 from Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> --- (In reply to Marc Véron from comment #14) > Hmm, my patch worked with a hash generated with the image file (as > recommended in comment #7), and it did not leave a security hole with > SelfCheckoutByLogin="barcode" Looks to me that this option is a security hole on itself? If I guess barcodes, I can still see all images? If I come on sco-main, I will automatically get the image from the img tag as well? Or do I misunderstand the discussion here? -- You are receiving this mail because: You are watching all bug changes.

1 0