April 2017 - Koha-bugs - lists.koha-community.org

[Bug 11213] GetItemsInfo() called twice
by bugzilla-daemon＠bugs.koha-community.org 20 Apr '17

20 Apr '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11213 Srdjan Jankovic <srdjan(a)catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #57578|0 |1 is obsolete| | --- Comment #114 from Srdjan Jankovic <srdjan(a)catalyst.net.nz> --- Created attachment 62434 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=62434&action=ed… bug_11213: Changed XSLTParse4Display() interface The list of biblio items is passed on now, instead of GetItemsInfo() being called. This is because the callers already have the list ready, so the GetItemsInfo() call is being duplicated unnecessarily. Search::searchResults() builds items list from XML, and that one is passed instead. * XSLT::XSLTParse4Display() - supply the items list as input param - removed hidden items list param - hidden should not be in the items list - changed buildKohaItemsNamespace() accordingly * Items - added sort_by input param to GetItemsInfo() * catalogue/detail.pl, opac/opac-detail.pl, shelfpage() - added items list to the XSLTParse4Display() call * Search::searchResults() - include all available info when building items lists - added combined items list (available, on loan, other) to the XSLTParse4Display() call To test: This change is a noop, so following screens need to be checked against any changes: * Intranet: - catalogue/search.pl (results) - catalogue/detail.pl - virtualshelves/shelves.pl * Opac - opac-search.pl (results, hidelostitems syspref on and off) - opac-detail.pl - opac-shelves.pl The display should stay the same before and after patch. The speed should increase though. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14803] Rental and fine fees are not updating on circulation screen
by bugzilla-daemon＠bugs.koha-community.org 20 Apr '17

20 Apr '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14803 --- Comment #25 from Srdjan Jankovic <srdjan(a)catalyst.net.nz> --- (In reply to Owen Leonard from comment #23) > Created attachment 62294 [details] > Screenshot showing a problem with the checkout box > > something weird happens when the patron's fines are past the > noissuescharge limit. The checkout form is hidden from all users, whether > they have permission to override or not. That may be an existing condition. I've made some changes to take in account AllowFineOverride pref. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14803] Rental and fine fees are not updating on circulation screen
by bugzilla-daemon＠bugs.koha-community.org 20 Apr '17

20 Apr '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14803 Srdjan Jankovic <srdjan(a)catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #60631|0 |1 is obsolete| | --- Comment #24 from Srdjan Jankovic <srdjan(a)catalyst.net.nz> --- Created attachment 62432 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=62432&action=ed… bug 14803: KOHA.Checkouts js object * Use javascript to: - update fines/checkouts info - show/hide checkouts form and messages * Created svc/patron/fines -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14803] Rental and fine fees are not updating on circulation screen
by bugzilla-daemon＠bugs.koha-community.org 20 Apr '17

20 Apr '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14803 Srdjan Jankovic <srdjan(a)catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 15490] Changing SIP response
by bugzilla-daemon＠bugs.koha-community.org 20 Apr '17

20 Apr '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15490 Liz Rea <liz(a)catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |liz(a)catalyst.net.nz Status|NEW |RESOLVED Resolution|--- |INVALID --- Comment #1 from Liz Rea <liz(a)catalyst.net.nz> --- Link is broken. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0

[Bug 7550] Self checkout: limit display of patron image to logged-in patron
by bugzilla-daemon＠bugs.koha-community.org 19 Apr '17

19 Apr '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7550 --- Comment #19 from Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> --- (In reply to Marc Véron from comment #18) > So again: Are we talking about different things? > Are you talking about accessing the SCO screen by guessing the card number? Well it will be hard to answer binarily apparently as you are considering it's 2 different things and I consider it's the same thing. When you load sco-main.pl it GET sco-patron-image.pl, so there is no different for me. As I said earlier both versions do the same thing and have the same problem. Just considering using Koha::Token is the way to go. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 7550] Self checkout: limit display of patron image to logged-in patron
by bugzilla-daemon＠bugs.koha-community.org 19 Apr '17

19 Apr '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7550 --- Comment #18 from Marc Véron <veron(a)veron.ch> --- Could it be that we talk about different things? The initial comment was: ----- The patron image display in the self-checkout takes a GET parameter from the image source, so if someone copied the image location and substituted the barcode string they could browse through all patron images: <img alt="" src="/cgi-bin/koha/sco/sco-patron-image.pl?cardnumber=XXXX"> It would offer patrons better privacy to limit that request based on the currently-logged-in user. ----- (Note that meanwhile the param is borrowernumber). So somebody who is logged in to SCO can browse through the images by guessing/changing the borrowernumber: http://192.168.1.31/cgi-bin/koha/sco/sco-patron-image.pl?borrowernumber=1 http://192.168.1.31/cgi-bin/koha/sco/sco-patron-image.pl?borrowernumber=2 With my two patches applied, a hash is added, based on the contents of the image. The contents of the image is stored in the database (as blob) The new link to display the image is something like: http://192.168.1.31/cgi-bin/koha/sco/sco-patron-image.pl?borrowernumber=1&c… If you copy this addres and change borrowernumber e.g. to 2, the image won't display. To create a hash that fits to borrowernumber 2, you would need the image, otherwise it is impossible. So again: Are we talking about different things? Are you talking about accessing the SCO screen by guessing the card number? -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 7550] Self checkout: limit display of patron image to logged-in patron
by bugzilla-daemon＠bugs.koha-community.org 19 Apr '17

19 Apr '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7550 --- Comment #17 from Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> --- I do not understand how your approach can protect the image in any way if SelfCheckoutByLogin="barcode". Hit /cgi-bin/koha/sco/sco-main.pl Guess a cardnumber => You see the image Both approaches have the same problem, that's why I suggest to add a warning on the about page. The only difference is that the second approach uses Koha::Token that it already used at different places. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 7550] Self checkout: limit display of patron image to logged-in patron
by bugzilla-daemon＠bugs.koha-community.org 19 Apr '17

19 Apr '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7550 --- Comment #16 from Marc Véron <veron(a)veron.ch> --- (In reply to Jonathan Druart from comment #15) > (In reply to Marc Véron from comment #14) > > (In reply to Jonathan Druart from comment #12) > > > Created attachment 62400 [details] [review] [review] [review] > > > [ALTERNATIVE-PATCH] Bug 7550: SCO - Restrict access of patron's image > > > > > > With this patch if SelfCheckoutByLogin is set to 'username and > > > password', only the logged in user will be able to see the image linked > > > to his/her logged in account. > > > If set to "barcode" we generate a token but it can be easily generated. > > > You should add a warning in the about page if > > > SelfCheckoutByLogin="barcode" and ShowPatronImageInWebBasedSelfCheck="Show". > > > > Hmm, my patch worked with a hash generated with the image file (as > > recommended in comment #7), and it did not leave a security hole with > > SelfCheckoutByLogin="barcode" > > Yes it does, on the same way as my patch. If you know the cardnumber (easy > to guess) of someone you can access his^Ctheir image. $patron_image->imagefile is a blob, no? - Really easy to guess. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 7550] Self checkout: limit display of patron image to logged-in patron
by bugzilla-daemon＠bugs.koha-community.org 19 Apr '17

19 Apr '17

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7550 --- Comment #15 from Jonathan Druart <jonathan.druart(a)bugs.koha-community.org> --- (In reply to Marc Véron from comment #14) > (In reply to Jonathan Druart from comment #12) > > Created attachment 62400 [details] [review] [review] > > [ALTERNATIVE-PATCH] Bug 7550: SCO - Restrict access of patron's image > > > > With this patch if SelfCheckoutByLogin is set to 'username and > > password', only the logged in user will be able to see the image linked > > to his/her logged in account. > > If set to "barcode" we generate a token but it can be easily generated. > > You should add a warning in the about page if > > SelfCheckoutByLogin="barcode" and ShowPatronImageInWebBasedSelfCheck="Show". > > Hmm, my patch worked with a hash generated with the image file (as > recommended in comment #7), and it did not leave a security hole with > SelfCheckoutByLogin="barcode" Yes it does, on the same way as my patch. If you know the cardnumber (easy to guess) of someone you can access his^Ctheir image. -- You are receiving this mail because: You are watching all bug changes.

1 0