March 2024 - Koha-bugs - lists.koha-community.org

[Bug 34478] Full CSRF protection
by bugzilla-daemon＠bugs.koha-community.org 12 Mar '24

12 Mar '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 --- Comment #186 from Fridolin Somers <fridolin.somers(a)biblibre.com> --- OK thanks for your comments. For the moment no backport -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 15516] Allow to place a hold on first available item from a group of titles
by bugzilla-daemon＠bugs.koha-community.org 12 Mar '24

12 Mar '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15516 --- Comment #471 from David Cook <dcook(a)prosentient.com.au> --- As I've noted before, trying to count multiple hold group members as part of the same hold has some fundamental problems. We'd need to pass the hold group to CanBookBeReserved/CanItemBeReserved to handle this better... It's tempting to spin out a new report just for refactoring those functions to take $args instead. I want to make an API endpoint at some point too for whether or not a reserve can be placed. I think National Library of Finland have done work on this, although it's more discovery interface specific so might not quite meet what I'd want it for... -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 15516] Allow to place a hold on first available item from a group of titles
by bugzilla-daemon＠bugs.koha-community.org 12 Mar '24

12 Mar '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15516 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Patch doesn't apply |Failed QA -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 15516] Allow to place a hold on first available item from a group of titles
by bugzilla-daemon＠bugs.koha-community.org 12 Mar '24

12 Mar '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15516 --- Comment #470 from David Cook <dcook(a)prosentient.com.au> --- Comment on attachment 162078 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162078 Bug 15516: Relevant controller changes and tests Review of attachment 162078: --> (https://bugs.koha-community.org/bugzilla3/page.cgi?id=splinter.html&bug=155…) ----------------------------------------------------------------- ::: Koha/Holds.pm @@ +213,5 @@ > + > +sub count_holds { > + my ( $self, $search_params ) = @_; > + > + $search_params = { These $search_params lines redefine the variable instead of updating the variable. This means that you end up selecting all holds and not just the holds for particular criteria (like an individual patron). -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 15516] Allow to place a hold on first available item from a group of titles
by bugzilla-daemon＠bugs.koha-community.org 12 Mar '24

12 Mar '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15516 --- Comment #469 from David Cook <dcook(a)prosentient.com.au> --- Found a nasty bug in Koha::Holds->count_holds(). I'm going to need to review this code in-depth again... -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 34478] Full CSRF protection
by bugzilla-daemon＠bugs.koha-community.org 12 Mar '24

12 Mar '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 --- Comment #185 from David Cook <dcook(a)prosentient.com.au> --- (In reply to David Cook from comment #184) > (In reply to David Cook from comment #183) > > However, I have been thinking a bit about how to provide some protection to > > stable branches. > > I think my abbreviated anti-CSRF plus bug 33259 (when it's ready) would be > an OK compromise for stable branches. Although as I say that I'm finding more changes that need to be backported to really support this... heh... -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 34478] Full CSRF protection
by bugzilla-daemon＠bugs.koha-community.org 12 Mar '24

12 Mar '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 --- Comment #184 from David Cook <dcook(a)prosentient.com.au> --- (In reply to David Cook from comment #183) > However, I have been thinking a bit about how to provide some protection to > stable branches. I think my abbreviated anti-CSRF plus bug 33259 (when it's ready) would be an OK compromise for stable branches. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 34478] Full CSRF protection
by bugzilla-daemon＠bugs.koha-community.org 12 Mar '24

12 Mar '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 --- Comment #183 from David Cook <dcook(a)prosentient.com.au> --- (In reply to Fridolin Somers from comment #182) > Not for backport I bet ? I don't think that it would be possible to backport this one. However, I have been thinking a bit about how to provide some protection to stable branches. Locally, I've applied the following: - Bug 36098 (the Koha::Session patches) - Bug 34755: Backport Koha::Token change from bug 34478 - Bug 34478: Add csrf-token in meta I've created a middleware based off Koha::Middleware::CSRF and then using a mix of ideas from Marcel and myself, I've used Javascript to inject CSRF tokens into forms and Koha API calls. At the moment, I'm testing this on the OPAC, and then I'm going to look at the Staff Interface. I want to do some more thinking about how we can use "Strict" in the SameSite attribute for the CGISESSID cookie to cover off CSRF for GET requests as well. Less of a problem for 34478 because it fixes a lot of stateful GET requests, but for older versions... -- Long story short... it might be worth backporting just "Bug 34478: Add csrf-token in meta" for now. Maybe a new bug report for that? -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 13706] Deduping authorities script (dedup_authorities.pl)
by bugzilla-daemon＠bugs.koha-community.org 11 Mar '24

11 Mar '24

1 0

[Bug 35955] New CSRF token generated everytime we need one
by bugzilla-daemon＠bugs.koha-community.org 11 Mar '24

11 Mar '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35955 --- Comment #13 from David Cook <dcook(a)prosentient.com.au> --- (In reply to Fridolin Somers from comment #12) > May we backport this for better performance ? I can't imagine that it would hurt. -- You are receiving this mail because: You are watching all bug changes.

1 0