March 2024 - Koha-bugs - lists.koha-community.org

[Bug 34478] Full CSRF protection
by bugzilla-daemon＠bugs.koha-community.org 12 Mar '24

12 Mar '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 --- Comment #185 from David Cook <dcook(a)prosentient.com.au> --- (In reply to David Cook from comment #184) > (In reply to David Cook from comment #183) > > However, I have been thinking a bit about how to provide some protection to > > stable branches. > > I think my abbreviated anti-CSRF plus bug 33259 (when it's ready) would be > an OK compromise for stable branches. Although as I say that I'm finding more changes that need to be backported to really support this... heh... -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 34478] Full CSRF protection
by bugzilla-daemon＠bugs.koha-community.org 12 Mar '24

12 Mar '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 --- Comment #184 from David Cook <dcook(a)prosentient.com.au> --- (In reply to David Cook from comment #183) > However, I have been thinking a bit about how to provide some protection to > stable branches. I think my abbreviated anti-CSRF plus bug 33259 (when it's ready) would be an OK compromise for stable branches. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 34478] Full CSRF protection
by bugzilla-daemon＠bugs.koha-community.org 11 Mar '24

11 Mar '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 --- Comment #183 from David Cook <dcook(a)prosentient.com.au> --- (In reply to Fridolin Somers from comment #182) > Not for backport I bet ? I don't think that it would be possible to backport this one. However, I have been thinking a bit about how to provide some protection to stable branches. Locally, I've applied the following: - Bug 36098 (the Koha::Session patches) - Bug 34755: Backport Koha::Token change from bug 34478 - Bug 34478: Add csrf-token in meta I've created a middleware based off Koha::Middleware::CSRF and then using a mix of ideas from Marcel and myself, I've used Javascript to inject CSRF tokens into forms and Koha API calls. At the moment, I'm testing this on the OPAC, and then I'm going to look at the Staff Interface. I want to do some more thinking about how we can use "Strict" in the SameSite attribute for the CGISESSID cookie to cover off CSRF for GET requests as well. Less of a problem for 34478 because it fixes a lot of stateful GET requests, but for older versions... -- Long story short... it might be worth backporting just "Bug 34478: Add csrf-token in meta" for now. Maybe a new bug report for that? -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 13706] Deduping authorities script (dedup_authorities.pl)
by bugzilla-daemon＠bugs.koha-community.org 11 Mar '24

11 Mar '24

1 0

[Bug 35955] New CSRF token generated everytime we need one
by bugzilla-daemon＠bugs.koha-community.org 11 Mar '24

11 Mar '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35955 --- Comment #13 from David Cook <dcook(a)prosentient.com.au> --- (In reply to Fridolin Somers from comment #12) > May we backport this for better performance ? I can't imagine that it would hurt. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 23335] New: "There are no items that can be placed on hold."
by bugzilla-daemon＠bugs.koha-community.org 11 Mar '24

11 Mar '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23335 Bug ID: 23335 Summary: "There are no items that can be placed on hold." Change sponsored?: --- Product: Koha Version: 18.11 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: jmmureithi(a)nationalbank.co.ke QA Contact: testopia(a)bugs.koha-community.org Created attachment 91571 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=91571&action=ed… THE MESSAGE APPEARING IN OPAC The clients/users are trying to place hold and the following message is displayed yet there are items: There are no items that can be placed on hold. -- You are receiving this mail because: You are watching all bug changes.

1 2

[Bug 32636] New: More info with batch patron deletion
by bugzilla-daemon＠bugs.koha-community.org 11 Mar '24

11 Mar '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32636 Bug ID: 32636 Summary: More info with batch patron deletion Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Tools Assignee: koha-bugs(a)lists.koha-community.org Reporter: cbrannon(a)cdalibrary.org QA Contact: testopia(a)bugs.koha-community.org When batch deleting patrons, it tells you how many patrons will be deleted. It would be great if it also told you how many patrons fit your parameters, but are being skipped because they have active loans or fees. Better yet, if that piece of information could link to a report showing which patrons are skipped and why, that would even be helpful. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 1

[Bug 15565] Place multiple item-level holds at once for the same record
by bugzilla-daemon＠bugs.koha-community.org 11 Mar '24

11 Mar '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15565 --- Comment #293 from Nick Clemens <nick(a)bywatersolutions.com> --- Created attachment 163055 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=163055&action=e… Bug 15565: Add 'DisplayMultiItemHolds' system preference to toggle display of multi item holds These patches allow the display of checkboxes instead of radio buttons for placing specific item holds in the OPAC and staff interface. This display is controlled by the system preference 'DisplayMultiItemHolds'. When disabled, the hold display is the same as in the past. When enabled, the user can select multiple items to place holds on at the same time. If there is an error placing one or more holds, an error will display on the following screen. Test plan: 0. Apply the patches and koha-plack --reload kohadev 1. Enable 'DisplayMultiItemHolds' syspref 2. In staff interface, go to a record with multiple holdable items 3. Check the boxes next to 2+ items and click the button to place the holds 4. Note that the holds are all placed (unless there is a failure) 5. Cancel the holds, and try again (but this time make Holds per record (count) only 1 in the circ rules) 6. Note that one of the holds is placed, but the others are not and an error message is displayed saying that one or more holds could not be placed because the holds per record was exceeded 7. Perform the same above procedure on the OPAC 8. If DisplayMultiPlaceHold is enabled, you can test placing multiple specific item holds across multiple bibs in the OPAC via the search results 9. If EnableItemGroups and EnableItemGroupHolds is enabled, you can test that you can either place item group holds or specific item holds. Toggling the checkboxes in the staff interface will uncheck the item group hold radio button. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 15565] Place multiple item-level holds at once for the same record
by bugzilla-daemon＠bugs.koha-community.org 11 Mar '24

11 Mar '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15565 --- Comment #292 from Nick Clemens <nick(a)bywatersolutions.com> --- Created attachment 163054 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=163054&action=e… Bug 15565: Place multiple holds on one or more records in OPAC -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 15565] Place multiple item-level holds at once for the same record
by bugzilla-daemon＠bugs.koha-community.org 11 Mar '24

11 Mar '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15565 --- Comment #291 from Nick Clemens <nick(a)bywatersolutions.com> --- Created attachment 163053 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=163053&action=e… Bug 15565: Tidy reserve/placerequest.pl -- You are receiving this mail because: You are watching all bug changes.

1 0