May 2019 - Koha-bugs - lists.koha-community.org

[Bug 22692] Logging in via cardnumber circumvents account logout
by bugzilla-daemon＠bugs.koha-community.org 02 May '19

02 May '19

1 0

[Bug 22478] Cross-site scripting vulnerability in paginations
by bugzilla-daemon＠bugs.koha-community.org 02 May '19

02 May '19

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22478 --- Comment #50 from Nick Clemens <nick(a)bywatersolutions.com> --- (In reply to Jonathan Druart from comment #45) > (In reply to Martin Renvoize from comment #43) > > Created attachment 89009 [details] [review] [review] > > Bug 22478: (QA follow-up) Update tests to check for any script tags > > I do not think these tests are correct. We want to test that the variable > are correctly escaped, not that a specific script (opac-shelves) will > replace an invalid value with a correct one (everything != 1 or 2 will be 2) Please file a follow-up if you think we need to fix this Jonathan, patches were pushed to stable and so master followed. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14546] Make staff client templates responsive
by bugzilla-daemon＠bugs.koha-community.org 02 May '19

02 May '19

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14546 Michal Denar <black23(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |black23(a)gmail.com -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 8807] Add Carton support to Koha
by bugzilla-daemon＠bugs.koha-community.org 02 May '19

02 May '19

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8807 Tomás Cohen Arazi <tomascohen(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |WISHLIST --- Comment #6 from Tomás Cohen Arazi <tomascohen(a)gmail.com> --- This would be interesting if we had a script to generate the carton files. Because we cannot ditch our current model as it is used for generating the Debian packages. I like the idea overall, but this bug should probably be closed until someone can work on a complete solution. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 22478] Cross-site scripting vulnerability in paginations
by bugzilla-daemon＠bugs.koha-community.org 02 May '19

02 May '19

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22478 Nick Clemens <nick(a)bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|unspecified |master Group|Koha security | Product|Koha security |Koha Component|Koha |Architecture, internals, | |and plumbing --- Comment #49 from Nick Clemens <nick(a)bywatersolutions.com> --- Awesome work all! Pushed to master for 19.05 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 11529] Add subtitle, medium and part fields to biblio table
by bugzilla-daemon＠bugs.koha-community.org 02 May '19

02 May '19

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11529 --- Comment #203 from Ere Maijala <ere.maijala(a)helsinki.fi> --- (In reply to Katrin Fischer from comment #188) > I am sorry, but after testing I feel we probably should aim for early 19.11 > instead of 19.05. While the basic change is not that complicated, in the sum > the changes are pretty heavy. I'm fine with that. If we can get it in early in the cycle, it's of course easier and any rough edges can be found. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 11529] Add subtitle, medium and part fields to biblio table
by bugzilla-daemon＠bugs.koha-community.org 02 May '19

02 May '19

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11529 --- Comment #202 from Ere Maijala <ere.maijala(a)helsinki.fi> --- (In reply to Katrin Fischer from comment #187) Thanks, Katrin. Comments below. > 1) RELEASE NOTES > > - Removes the Koha to Keyword mappings > - Might cause change in behaviour for people having mappign fields outside > of 245bhnp or UNIMARC equivalents > - Requires you to run misc/batchRebuildBiblioTables.pl to have 245bhnp > displayed Do you want me to clarify these in the proposed release notes? > 2) Template Toolkit Stash > > I noticed some of the files use Stash. I haven't come across this so far. > Can you explain? Ah, I didn't notice it's only for development. I just used it to collect all the template params to a hash, but changed the code to pass biblio to the template in one case (the other actually already had it). > 3) SplitKohaField > > I wonder if the use case warrants its own subroutine, it's only used in > a few places and for splitting a pipe separeted string into an array: You're right. Now removed. > 4) Template variables > > Right now the changes require a lot of new variables passed to the templates > and some older SQL methods to be extended to SELECT additional fields. > I wonder if instead of working with an INCLUDE working with a TT plugin > taking the biblionumber and querying would hurt performance much. It would > allow > us to remove quite a bit of code I think. Also I guess in the future working > with > a Record object might make things easier? It's true, but the primary aim was to improve performance, and while fetching the data for a single record is not that bad, it's not optimal either, and when there's a list of records of any kind it can be significant. In some cases we could just pass the biblio object instead of select pieces of it, but I feel that's something that could be addressed in a follow-up issue, since this is usually just extending the existing practice. > 5) misc/batchRebuildBiblioTables.pl > > I noticed that you removed the table locking. Is this safe? It was only commented-out code that I cleaned up. > 6) Unrelated changes Fixed. > 7) Repeatable subfields np > > Testing with: 245abhnpnp > Multiple np show as: > The C programming language / Zusatz Number | Number2 Part | Part2 > > Actually this is a deeper rabbit hole... as we don't keep the sequence we > might lose meaning here, but that would not have worked before. I made the templates handle repeated fields a bit better. At least I think they would normally be interleaved, and that's how they're now displayed. It's perhaps still not perfect, but at least it works properly with ISBD punctuation, and further tweaks are easy to add later as necessary. Please note that qa-test-tools is not happy about the WHILE statement in the biblio-title* templates, but that seems to be a spurious error. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 11529] Add subtitle, medium and part fields to biblio table
by bugzilla-daemon＠bugs.koha-community.org 02 May '19

02 May '19

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11529 --- Comment #201 from Ere Maijala <ere.maijala(a)helsinki.fi> --- Created attachment 89246 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=89246&action=ed… Bug 11529: (follow-up) Fix QA issues - Remove SplitKohaField - Avoid using Stash in templates - Improved display of part fields -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 11529] Add subtitle, medium and part fields to biblio table
by bugzilla-daemon＠bugs.koha-community.org 02 May '19

02 May '19

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11529 Ere Maijala <ere.maijala(a)helsinki.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #89107|0 |1 is obsolete| | --- Comment #200 from Ere Maijala <ere.maijala(a)helsinki.fi> --- Created attachment 89245 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=89245&action=ed… Bug 11529: (follow-up) Fix link on hold request page Signed-off-by: Josef Moravec <josef.moravec(a)gmail.com> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 11529] Add subtitle, medium and part fields to biblio table
by bugzilla-daemon＠bugs.koha-community.org 02 May '19

02 May '19

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11529 Ere Maijala <ere.maijala(a)helsinki.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #89106|0 |1 is obsolete| | --- Comment #199 from Ere Maijala <ere.maijala(a)helsinki.fi> --- Created attachment 89244 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=89244&action=ed… Bug 11529: Add templates for biblio title display. Unify display. Signed-off-by: Josef Moravec <josef.moravec(a)gmail.com> -- You are receiving this mail because: You are watching all bug changes.

1 0