February 2022 - Koha-bugs - lists.koha-community.org

[Bug 26102] Javascript injection in intranet search
by bugzilla-daemon＠bugs.koha-community.org 21 Feb '22

21 Feb '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26102 --- Comment #50 from Jonathan Druart <jonathan.druart+koha(a)gmail.com> --- Created attachment 130935 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=130935&action=e… Bug 26102: [19.11] Prevent XSS when To.json is used: guarantor_search.tt To test, edit a patron record and go through the process of adding a guarantor. In the guarantor search results table the address should be displayed correctly. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 26102] Javascript injection in intranet search
by bugzilla-daemon＠bugs.koha-community.org 21 Feb '22

21 Feb '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26102 --- Comment #49 from Jonathan Druart <jonathan.druart+koha(a)gmail.com> --- Created attachment 130934 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=130934&action=e… Bug 26102: [19.11] Prevent XSS when To.json is used: catalogue/results.tt To test, perform a search in the catalogue and verify that search term highlighting works correctly. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 26102] Javascript injection in intranet search
by bugzilla-daemon＠bugs.koha-community.org 21 Feb '22

21 Feb '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26102 --- Comment #48 from Jonathan Druart <jonathan.druart+koha(a)gmail.com> --- Created attachment 130933 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=130933&action=e… Bug 26102: [19.11] Prevent XSS when To.json is used: authorities/blinddetail-biblio-search.tt Test the process of searching for and selecting an authority record for use in the basic MARC editor. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 26102] Javascript injection in intranet search
by bugzilla-daemon＠bugs.koha-community.org 21 Feb '22

21 Feb '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26102 --- Comment #47 from Jonathan Druart <jonathan.druart+koha(a)gmail.com> --- Created attachment 130932 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=130932&action=e… Bug 26102: [19.11] Prevent XSS when To.json is used: authorities/authorities.tt Check that mandatory tags and subfields are correctly required when editing an authority record. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 26102] Javascript injection in intranet search
by bugzilla-daemon＠bugs.koha-community.org 21 Feb '22

21 Feb '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26102 --- Comment #46 from Jonathan Druart <jonathan.druart+koha(a)gmail.com> --- Created attachment 130931 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=130931&action=e… Bug 26102: [19.11] Prevent XSS when To.json is used: admin/preferences.tt Test that preference search term highlighting works correctly. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 26102] Javascript injection in intranet search
by bugzilla-daemon＠bugs.koha-community.org 21 Feb '22

21 Feb '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26102 Jonathan Druart <jonathan.druart+koha(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |30044 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30044 [Bug 30044] Z39.50/SRU search button broken by update to 19.11.25 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29840] New: opac-reserve explodes if invalid biblionumber is passed
by bugzilla-daemon＠bugs.koha-community.org 21 Feb '22

21 Feb '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29840 Bug ID: 29840 Summary: opac-reserve explodes if invalid biblionumber is passed Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: ASSIGNED Severity: normal Priority: P5 - low Component: OPAC Assignee: jonathan.druart+koha(a)gmail.com Reporter: jonathan.druart+koha(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org An error message should be displayed instead. Can't call method "holds" on an undefined value at /kohadevbox/koha/opac/opac-reserve.pl line 172 -- You are receiving this mail because: You are watching all bug changes.

1 13

[Bug 29838] New: No string interpolation when expected in t/db_dependent/ImportBatch.t
by bugzilla-daemon＠bugs.koha-community.org 21 Feb '22

21 Feb '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29838 Bug ID: 29838 Summary: No string interpolation when expected in t/db_dependent/ImportBatch.t Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: ASSIGNED Severity: minor Priority: P5 - low Component: Test Suite Assignee: jonathan.druart+koha(a)gmail.com Reporter: jonathan.druart+koha(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org -my $batch3_clean = $dbh->do('SELECT * FROM import_records WHERE import_batch_id = "$id_import_batch3"'); -- You are receiving this mail because: You are watching all bug changes.

1 13

[Bug 29646] New: opac-password-recovery crash on wrong borrower_number
by bugzilla-daemon＠bugs.koha-community.org 21 Feb '22

21 Feb '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29646 Bug ID: 29646 Summary: opac-password-recovery crash on wrong borrower_number Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: m.de.rooy(a)rijksmuseum.nl QA Contact: testopia(a)bugs.koha-community.org Seeing this in 20.11 but code in master has not changed: Can't call method "category" on an undefined value at /usr/share/koha/opac/opac-password-recovery.pl line 204 eval {...} at /usr/share/koha/opac/opac-password-recovery.pl line 2 CGI::Compile::ROOT::usr_share_koha_opac_opac_2dpassword_2drecovery_2epl::__ANON__('CGI::Compile=HASH(0x56477a9a9208)', '', '/usr/share/koha/opac/opac-password-recovery.pl', '/usr/share/koha/opac', 'ARRAY(0x56477b4391f0)') called at /usr/share/perl5/CGI/Compile.pm line 151 Code looks like: if ( !$borrower_number ) { $errLinkNotValid = 1; } my $borrower = Koha::Patrons->find($borrower_number); $template->param( new_password => 1, email => $email, uniqueKey => $uniqueKey, username => $username, errLinkNotValid => $errLinkNotValid, hasError => ( $errLinkNotValid ? 1 : 0 ), minPasswordLength => $borrower->category->effective_min_password_length, RequireStrongPassword => $borrower->category->effective_require_strong_password If the borrower_number is not found, the $borrower->category crashes. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 15

[Bug 11750] Overdue report does not limit patron attributes
by bugzilla-daemon＠bugs.koha-community.org 21 Feb '22

21 Feb '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11750 Victor Grousset/tuxayo <victor(a)tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Pushed to oldstable |RESOLVED CC| |victor(a)tuxayo.net --- Comment #10 from Victor Grousset/tuxayo <victor(a)tuxayo.net> --- Not backported to oldoldstable (20.11.x). Feel free to ask if it's needed. -- You are receiving this mail because: You are watching all bug changes.

1 0