November 2024 - Koha-bugs - lists.koha-community.org

[Bug 35184] New: Consolidate UNIMARC value builders for 100, 124, 125, 125
by bugzilla-daemon＠bugs.koha-community.org 23 Feb '25

23 Feb '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35184 Bug ID: 35184 Summary: Consolidate UNIMARC value builders for 100, 124, 125, 125 Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Cataloging Assignee: koha-bugs(a)lists.koha-community.org Reporter: katrin.fischer(a)bsz-bw.de QA Contact: testopia(a)bugs.koha-community.org CC: m.de.rooy(a)rijksmuseum.nl It looks like all these plugins do the same. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 4

[Bug 38378] New: Can't delete frequencies due to stray cud- in del op
by bugzilla-daemon＠bugs.koha-community.org 21 Feb '25

21 Feb '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38378 Bug ID: 38378 Summary: Can't delete frequencies due to stray cud- in del op Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Serials Assignee: koha-bugs(a)lists.koha-community.org Reporter: lmstrand(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org serials/subscription-frequencies.pl has a delete op that was changed to cud-del when it shouldn't have been. This breaks the delete button's function. Existing subscription frequencies cannot be deleted and the button does nothing. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 38

[Bug 38463] New: Unnecessary CSRF token in OPAC authority search
by bugzilla-daemon＠bugs.koha-community.org 21 Feb '25

21 Feb '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38463 Bug ID: 38463 Summary: Unnecessary CSRF token in OPAC authority search Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: OPAC Assignee: phil(a)chetcolibrary.org Reporter: phil(a)chetcolibrary.org QA Contact: testopia(a)bugs.koha-community.org Depends on: 37069 Bug 37069 correctly changed OPAC authority searches from a POST to a GET, but forgot to remove the CSRF token that is only needed for a POST, so now it clutters up the URL by making the first 107 characters of the query string meaningless. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37069 [Bug 37069] Authorities pagination on OPAC broken by CSRF -- You are receiving this mail because: You are watching all bug changes.

1 16

[Bug 38328] New: Cannot delete ILL batch statuses
by bugzilla-daemon＠bugs.koha-community.org 21 Feb '25

21 Feb '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38328 Bug ID: 38328 Summary: Cannot delete ILL batch statuses Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: System Administration Assignee: phil(a)chetcolibrary.org Reporter: phil(a)chetcolibrary.org QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Depends on: 36192 You are permitted to delete ILL batch statuses that you (rather than the system) add, but the UI didn't get the CSRF memo about delete ops needing to be POSTs with op="cud-delete", so it still uses a GET of ?op="delete" and fails. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 [Bug 36192] [OMNIBUS] CSRF Protection for Koha -- You are receiving this mail because: You are watching all bug changes.

1 14

[Bug 38309] New: Cannot delete additional fields
by bugzilla-daemon＠bugs.koha-community.org 21 Feb '25

21 Feb '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38309 Bug ID: 38309 Summary: Cannot delete additional fields Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: System Administration Assignee: koha-bugs(a)lists.koha-community.org Reporter: nick(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com To recreate: 1 - Browse to Administration->Additional fields 2 - Click 'Invoices (aqinvoices)' 3 - Click 'New field' 4 - Fill out form and save 5 - See the new fiellisted 6 - Click 'Delete', confirm 7 - Screen goes blank 8 - Try to click 'Additional fields' in breadcrumb, no action 9 - Click 'Administration' in breadcrums 10 - Go to Additional fields->Invoices 11 - Your field is still there -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 19

[Bug 37961] New: Inventory followup fails by POSTing without an op or csrf_token
by bugzilla-daemon＠bugs.koha-community.org 21 Feb '25

21 Feb '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37961 Bug ID: 37961 Summary: Inventory followup fails by POSTing without an op or csrf_token Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Keywords: regression, rel_24_05_candidate Severity: major Priority: P1 - high Component: Tools Assignee: phil(a)chetcolibrary.org Reporter: phil(a)chetcolibrary.org QA Contact: testopia(a)bugs.koha-community.org Depends on: 36192 After you upload a file or textarea of barcodes to inventory, the next step is a list of the things that were missing, with checkboxes to check when you find them, and buttons to Mark seen, which send a POST to /cgi-bin/koha/tools/ajax-inventory.pl without an op param (since it doesn't have an $op) and without a csrf_token, so the POST fails with a 403. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 [Bug 36192] [OMNIBUS] CSRF Protection for Koha -- You are receiving this mail because: You are watching all bug changes.

1 16

[Bug 37914] New: Forms for budget planning filters and export should GET rather than POST
by bugzilla-daemon＠bugs.koha-community.org 21 Feb '25

21 Feb '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37914 Bug ID: 37914 Summary: Forms for budget planning filters and export should GET rather than POST Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P3 Component: Acquisitions Assignee: phil(a)chetcolibrary.org Reporter: phil(a)chetcolibrary.org QA Contact: testopia(a)bugs.koha-community.org Depends on: 36192 Blocks: 37728 Because of the bug 36192 CSRF protection, we intend not to have forms that POST without a param named 'op' with a value starting with 'cud-'. Because of bug 37728, a few were missed, including the 'Filters' form that lets you switch between planning budgets by month or by itemtype or by library, and the 'Export' form that lets you save your planning as a .csv file. Neither one has any need to POST, they can just be the GET they naturally are. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 [Bug 36192] [OMNIBUS] CSRF Protection for Koha https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37728 [Bug 37728] More "op" are missing in POSTed forms -- You are receiving this mail because: You are watching all bug changes.

1 16

[Bug 37959] New: Item circulation alerts table appears to be broken
by bugzilla-daemon＠bugs.koha-community.org 21 Feb '25

21 Feb '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37959 Bug ID: 37959 Summary: Item circulation alerts table appears to be broken Change sponsored?: --- Product: Koha Version: 24.05 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Staff interface Assignee: koha-bugs(a)lists.koha-community.org Reporter: esther.melander(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com To replicate: 1. Click on a cell in the table. The cell changes to save "Saving..." and then appears to become stuck. Nothing ever happens. Refreshing the page returns to the table to its original state. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 22

[Bug 37887] New: OPAC password recovery needs to use a cud- op while POSTing new password
by bugzilla-daemon＠bugs.koha-community.org 21 Feb '25

21 Feb '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37887 Bug ID: 37887 Summary: OPAC password recovery needs to use a cud- op while POSTing new password Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P3 Component: OPAC Assignee: phil(a)chetcolibrary.org Reporter: phil(a)chetcolibrary.org QA Contact: testopia(a)bugs.koha-community.org Depends on: 36192 Blocks: 37728 The intention of the CSRF protection from bug 36192 was that any form that used method="post" would have to have a param named 'op' which started with 'cud-' but the test that verifies they do missed the case of a template with more than one form. Bug 37728 corrects that, but to land, the things that currently fail the test need to be fixed. In opac-password-recovery.tt that's the fairly critical step where the user sets a new password. Luckily, getting there requires the uniqueKey that's sent in the recovery email, and if someone has access to that you've already lost the game, so it's not really a security issue, just something that needs to be fixed. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 [Bug 36192] [OMNIBUS] CSRF Protection for Koha https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37728 [Bug 37728] More "op" are missing in POSTed forms -- You are receiving this mail because: You are watching all bug changes.

1 14

[Bug 37853] New: Returning to your account at the end of changing your password in the OPAC doesn't need to POST a form
by bugzilla-daemon＠bugs.koha-community.org 21 Feb '25

21 Feb '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37853 Bug ID: 37853 Summary: Returning to your account at the end of changing your password in the OPAC doesn't need to POST a form Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P3 Component: OPAC Assignee: phil(a)chetcolibrary.org Reporter: phil(a)chetcolibrary.org QA Contact: testopia(a)bugs.koha-community.org Depends on: 36192 Blocks: 37728 The end of the UI flow of changing your password in the OPAC is a page which tells you your password was changed (good, you need to know it's time to log out and back in to change your saved password, or that it's time to scribble out the old one on a Post-it and write down the new one), and then offers to take you back to your account with a button in a form which does a POST to opac-user.pl without an op and with your borrowernumber, which is double-bad. We intend not to allow POST without an op, and once the test is fixed in bug 37728 this will fail, and there's no need for the borrowernumber since it will be completely ignored by the script, which will instead get it from your cookie or make you log in. Instead of a form+button+POST, it should just be a link. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 [Bug 36192] [OMNIBUS] CSRF Protection for Koha https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37728 [Bug 37728] More "op" are missing in POSTed forms -- You are receiving this mail because: You are watching all bug changes.

1 13