January 2023 - Koha-bugs - lists.koha-community.org

[Bug 14784] Missing checkin message for debarred patrons when issuing rules 'fine days = 0'
by bugzilla-daemon＠bugs.koha-community.org 17 Jan '23

17 Jan '23

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14784 --- Comment #82 from Martin Renvoize <martin.renvoize(a)ptfs-europe.com> --- Nice work everyone! Pushed to 23.05.x for the next release -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14784] Missing checkin message for debarred patrons when issuing rules 'fine days = 0'
by bugzilla-daemon＠bugs.koha-community.org 17 Jan '23

17 Jan '23

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14784 Martin Renvoize <martin.renvoize(a)ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to master Version(s)| |23.05.00 released in| | -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 32637] New: API requests using Content-Type: application/x-www-form-urlencoded fail, user data treated as DB column name
by bugzilla-daemon＠bugs.koha-community.org 16 Jan '23

16 Jan '23

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32637 Bug ID: 32637 Summary: API requests using Content-Type: application/x-www-form-urlencoded fail, user data treated as DB column name Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: REST API Assignee: koha-bugs(a)lists.koha-community.org Reporter: data-27FC05A3CB97(a)office-dateien.de CC: tomascohen(a)gmail.com Created attachment 145327 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=145327&action=e… IRC log Requests to the REST API will fail if the Content-type HTTP header is set to application/x-www-form-urlencoded. This is the default header sent by curl if nothing else is specified. curl -v -s -u kohaapi:kohaapi --request GET http://koha_testing/api/v1/patrons --data-raw '{ "surname": { "-like": "Smith%" } }' {"error":"Something went wrong, check Koha logs for details.","error_code":"internal_server_error"} The following entry shows up in api-error.log [ERROR] GET /api/v1/patrons: unhandled exception (DBIx::Class::Exception)<<DBIx::Class::Storage::DBI::_dbh_execute(): DBI Exception: DBD::mysql::st execute failed: Unknown column '{ "surname": { "-like": "Smith%" } }' in 'where clause' at /usr/share/perl5/Data/Page.pm line 49>> Koha::REST::Plugin::Exceptions::__ANON__ /usr/share/koha/lib/Koha/REST/Plugin/Exceptions.pm (73) Specifying any Content-type header, or not sending one at all will make the issue go away: curl -v -s -u kohaapi:kohaapi --header "Content-type: application/json" --request GET http://koha_testing/api/v1/patrons --data-raw '{ "surname": { "-like": "Smith%" } }' It appears that sending Content-type: application/x-www-form-urlencoded causes Koha to treat the complete user supplied data as a column name of the borrowers table and running a query with it. It then fails because such a column does not exist. With Koha 22.05, the following will not cause an error, as firstname is a valid column name in the borrowers table, so no query fails and no data is returned. This also works with the items table. curl -v -s -u kohaapi:kohaapi --request GET http://koha_testing/api/v1/patrons --data-raw 'firstname' This won't work if any Content-type header is set as this causes an error: {"errors":[{"message":"Expected object - got string.","path":"\/query"}],"status":400} It appears that x-www-form-urlencoded also overrides the JSON sanity check. It is not clear why x-www-form-urlencoded is treated special in the first place and why using it allows user supplied data to be passed to the database unchecked. The security implications of this behavior would need to be checked too to avoid things like SQL injections. Tests were done on Koha 22.05 and 22.11 running on Debian Bullseye. Koha was installed using the Debian packages on a newly installed machine. The IRC log is attached. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 2

[Bug 12225] SIP does not respect the "no block" flag
by bugzilla-daemon＠bugs.koha-community.org 16 Jan '23

16 Jan '23

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12225 --- Comment #36 from Katrin Fischer <katrin.fischer(a)bsz-bw.de> --- (In reply to Blou from comment #35) > funny. checkout_no_block doesn't exist since forever, and this patch fixes > it after all these years... but no fix for checkin_no_block. Any 09Y call > crashes and die. Bug 32515 might help. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 12225] SIP does not respect the "no block" flag
by bugzilla-daemon＠bugs.koha-community.org 16 Jan '23

16 Jan '23

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12225 Blou <philippe.blouin(a)inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |philippe.blouin(a)inlibro.com --- Comment #35 from Blou <philippe.blouin(a)inlibro.com> --- funny. checkout_no_block doesn't exist since forever, and this patch fixes it after all these years... but no fix for checkin_no_block. Any 09Y call crashes and die. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29955] New: Move C4::Acquisition::populate_order_with_prices to Koha::Acquisition::Order
by bugzilla-daemon＠bugs.koha-community.org 16 Jan '23

16 Jan '23

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29955 Bug ID: 29955 Summary: Move C4::Acquisition::populate_order_with_prices to Koha::Acquisition::Order Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: ASSIGNED Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: julian.maurice(a)biblibre.com Reporter: julian.maurice(a)biblibre.com QA Contact: testopia(a)bugs.koha-community.org Blocks: 21204 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21204 [Bug 21204] Move C4::Acquisition code to the Koha namespace [OMNIBUS] -- You are receiving this mail because: You are watching all bug changes.

1 35

[Bug 5928] Allow selection of "purchase for" library in Purchase Suggestions
by bugzilla-daemon＠bugs.koha-community.org 16 Jan '23

16 Jan '23

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5928 Ranjan <librarian(a)pilani.bits-pilani.ac.in> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |librarian(a)pilani.bits-pilan | |i.ac.in -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 789] Cannot search for member by last name, first name
by bugzilla-daemon＠bugs.koha-community.org 16 Jan '23

16 Jan '23

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=789 Ranjan <librarian(a)pilani.bits-pilani.ac.in> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |librarian(a)pilani.bits-pilan | |i.ac.in -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 18186] New: Amounts with decimal comma instead of decimal dot breaking payments
by bugzilla-daemon＠bugs.koha-community.org 16 Jan '23

16 Jan '23

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18186 Bug ID: 18186 Summary: Amounts with decimal comma instead of decimal dot breaking payments Change sponsored?: --- Product: Koha Version: 3.22 Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: katrin.fischer(a)bsz-bw.de QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com In our current installations running under Plack, the amounts on the pay and paycollect pages suddenly started showing with a decimal comma instead of a decimal point. This causes quite a bit of trouble, as Koha expects a . and amounts entered didn't result in the expected payments. We got several reports about payments being broken in Koha. Test plan: - Add manual invoice - View the "fines" tag - Verify that individual fees and totals display with , instead of . - Pay selected or any amount - Verify that the input field for the amount is also showing the , - Verify that paying something like 1,10 doesn't work as expected. The problem with the test plan is, that you might not see the ,. This appears only on our productions servers, but not in my development environment. We tested: - different language settings in Koha - different language settings in the browser - verified that CurrencyFormat isn't used in the code on those page - verified that all the formatting done was using the TT filter format('%.2f') In the end the problem turned out to be related to Plack. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 16

[Bug 30739] New: Fatal errors during MARC import force status of "Importing" forever
by bugzilla-daemon＠bugs.koha-community.org 16 Jan '23

16 Jan '23

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30739 Bug ID: 30739 Summary: Fatal errors during MARC import force status of "Importing" forever Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: MARC Bibliographic record staging/import Assignee: koha-bugs(a)lists.koha-community.org Reporter: dcook(a)prosentient.com.au QA Contact: testopia(a)bugs.koha-community.org We need to be careful when processing MARC imports. I was trying to import 1 MARC record with 1 item, and it kept getting stuck as 0% job progress and "Importing" status forever. Thanks to Bug 30738, I saw this was due to the following error: [2022/05/12 03:37:37] [WARN] DBIx::Class::Storage::DBI::_dbh_execute(): DBI Exception: DBD::mysql::st execute failed: Data too long for column 'coded_location_qualifier' at row 1 at /kohadevbox/koha/Koha/Object.pm line 170 main::__ANON__ /kohadevbox/koha/tools/manage-marc-import.pl (339) -- Either we need to fail the whole import or we need to catch the error and just report on it at the end. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 11