May 2024 - Koha-bugs - lists.koha-community.org

[Bug 35984] New: automated static code analysis should include security tests
by bugzilla-daemon＠bugs.koha-community.org 04 Aug '25

04 Aug '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35984 Bug ID: 35984 Summary: automated static code analysis should include security tests Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: evelyn(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org A few libraries have asked recently if, prior to production/during the development lifecycle, automated source code analysis tools are used to test for security flaws specifically. Typically these questions are in relation to processes like renewing cybersecurity insurance or initial discovery by a potential partner library's security/IT department. Perlcritic seems to be currently used, but as far as I can tell it appears the tests are for enforcing the coding standard. Using an automated tool to look for security flaws will be a beneficial addition to the project, so I'd like to at least start the discussion here. OWASP has an informational page for further reading: https://owasp.org/www-community/controls/Static_Code_Analysis -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 4

[Bug 30594] New: Package Crypt::CBC 2.35 or higher to increase security
by bugzilla-daemon＠bugs.koha-community.org 04 Aug '25

04 Aug '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30594 Bug ID: 30594 Summary: Package Crypt::CBC 2.35 or higher to increase security Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Packaging Assignee: koha-bugs(a)lists.koha-community.org Reporter: martin.renvoize(a)ptfs-europe.com QA Contact: testopia(a)bugs.koha-community.org CC: mtj(a)kohaaloha.com Currently, Debian mostly comes with Crypt::CBC 2.33 pre-packaged. If we package 2.35 or above we can benefit from a performance boost as well as having the ability to update our derivation function to using the recommended pbkdf2 algorithm instead of the backwards compatible default of opensslv1. If we choose to package this, we should also update Koha::Encryption to reflect the change and use pbkdf2. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 5

[Bug 35519] New: apt install koha-common has error with koha-l10n
by bugzilla-daemon＠bugs.koha-community.org 02 Aug '25

02 Aug '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35519 Bug ID: 35519 Summary: apt install koha-common has error with koha-l10n Change sponsored?: --- Product: Koha Version: 23.05 Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Packaging Assignee: koha-bugs(a)lists.koha-community.org Reporter: wizzyrea(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org CC: mtj(a)kohaaloha.com Tomas said he saw this too, so it's not my (really Kyle's) custom package. :) Installing koha-common with apt install koha-common=<the package version string> with 23.05.06 over the top of an older version errors out as follows: dpkg: error processing archive /tmp/apt-dpkg-install-tZKDjI/062-koha-l10n_23.05.06-1_all.deb (--unpack): trying to overwrite '/usr/share/koha/misc/translator/po/am-Ethi-installer-MARC21.po', which is also in package koha-common 23.05.05 This can be fixed by running apt install -f and subsequent installs are ok. Cheers, Liz -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 4

[Bug 32287] New: Capitalization: Printing and/or Publishing Information Transcribed as Found in the Colophon:␠
by bugzilla-daemon＠bugs.koha-community.org 01 Aug '25

01 Aug '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32287 Bug ID: 32287 Summary: Capitalization: Printing and/or Publishing Information Transcribed as Found in the Colophon:␠ Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Keywords: Academy Severity: trivial Priority: P5 - low Component: Templates Assignee: oleonard(a)myacpl.org Reporter: katrin.fischer(a)bsz-bw.de QA Contact: testopia(a)bugs.koha-community.org Found while translating: Printing and/or Publishing Information Transcribed as Found in the Colophon:␠ koha-tmpl/intranet-tmpl/prog/en/xslt/UNIMARCslimUtils.xsl:161 koha-tmpl/opac-tmpl/bootstrap/en/xslt/UNIMARCslimUtils.xsl:322 and Printing and/or Publishing Information Transcribed as Found in the Main Source of Information:␠ koha-tmpl/intranet-tmpl/prog/en/xslt/UNIMARCslimUtils.xsl:180 koha-tmpl/opac-tmpl/bootstrap/en/xslt/UNIMARCslimUtils.xsl:341 -- You are receiving this mail because: You are watching all bug changes.

1 14

[Bug 32284] New: Capitalization: Audio Carriers
by bugzilla-daemon＠bugs.koha-community.org 01 Aug '25

01 Aug '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32284 Bug ID: 32284 Summary: Capitalization: Audio Carriers Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Keywords: Academy Severity: trivial Priority: P5 - low Component: Templates Assignee: oleonard(a)myacpl.org Reporter: katrin.fischer(a)bsz-bw.de QA Contact: testopia(a)bugs.koha-community.org koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_183a.tt:15 Audio Carriers should be Audio carriers -- You are receiving this mail because: You are watching all bug changes.

1 18

[Bug 35945] New: Expand OverduesBlockCirc to guarantees and guarantors
by bugzilla-daemon＠bugs.koha-community.org 01 Aug '25

01 Aug '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35945 Bug ID: 35945 Summary: Expand OverduesBlockCirc to guarantees and guarantors Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Patrons Assignee: koha-bugs(a)lists.koha-community.org Reporter: caroline.cyr-la-rose(a)inlibro.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com We have NoIssuesChargeGuarantees and NoIssuesChargeGuarantorsWithGuarantees to expand noissuescharge to block checkouts for the patron's guarantor(s) and sibling(s). A lot of libraries are abolishing fines, and still need some way to block family accounts of overdue patrons. We could add - OverduesBlockCircGuarantor -> Block guarantor's account when guarantees have overdues - OverduesBlockCircGuarantorsWithGuarantees -> Block sibling accounts when a guarantee has overdues And maybe - OverduesBlockCircGuarantorDays -> Only block guarantor's account when guarantees have overdues of X days or more - OverduesBlockCircGuarantorsWithGuaranteesDays -> Only block sibling accounts when guarantees have overdues of X days or more Or combine the days with the main prefs, like noissuescharge. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 4

[Bug 16943] New: OverduesBlockCheckout ask for confirmation once per session
by bugzilla-daemon＠bugs.koha-community.org 01 Aug '25

01 Aug '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16943 Bug ID: 16943 Summary: OverduesBlockCheckout ask for confirmation once per session Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: arm(a)hanover.ca QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com Just a minor suggestion... OverduesBlockCheckout has an option to 'ask for confirmation'. When checking out to a patron with any overdue items, the prompt to confirm comes up for each and every item you check out. I would prefer it to appear for staff confirmation just once for the current patron checkout session, the same as the AllFinesNeedOverride prompt does. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 11

[Bug 32594] New: Add a dedicated ES indexing background worker
by bugzilla-daemon＠bugs.koha-community.org 01 Aug '25

01 Aug '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32594 Bug ID: 32594 Summary: Add a dedicated ES indexing background worker Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Searching - Elasticsearch Assignee: koha-bugs(a)lists.koha-community.org Reporter: nick(a)bywatersolutions.com When pushing the ES indexing jobs to the background queue, we have found it is hard for the workers to keep up in production. During high circulation times there are many single record reindexes produced. It would be nice to have a dedicated ES worker that can batch these to reduce the processing time and reduce the hits to the ES server -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 77

[Bug 29154] New: Add hold cancellation reason to Holds Awaiting Pickup page
by bugzilla-daemon＠bugs.koha-community.org 01 Aug '25

01 Aug '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29154 Bug ID: 29154 Summary: Add hold cancellation reason to Holds Awaiting Pickup page Change sponsored?: --- Product: Koha Version: 21.05 Hardware: Macintosh OS: Mac OS Status: NEW Severity: normal Priority: P5 - low Component: Hold requests Assignee: koha-bugs(a)lists.koha-community.org Reporter: pnavarrete(a)cca.edu QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Using the authorized value "HOLD_CANCELLATION" allows us to choose a reason a hold was cancelled, which then triggers a patron notice. However, the option to choose a reason does not appear on the Holds Awaiting Pickup page, which is where we cancel holds from often. Can the hold cancellation options be added to this page? -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 12

[Bug 26282] New: Allow staff to decide if a hold cancellation notice will be sent when cancelling a hold
by bugzilla-daemon＠bugs.koha-community.org 01 Aug '25

01 Aug '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26282 Bug ID: 26282 Summary: Allow staff to decide if a hold cancellation notice will be sent when cancelling a hold Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Hold requests Assignee: koha-bugs(a)lists.koha-community.org Reporter: katrin.fischer(a)bsz-bw.de QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Depends on: 25534 Bug 25534 adds the option to send hold cancellation notices when a reason was given. It would be nice if you could give a reason but still decide not to send to the patron. Say the patron called and will not be able to pick up numerous holds for some time. You cancel them all with "patron requested cancellation" but don't want to send multiple notices. I could imagine a checkbox next to the reason to activate/deactivate sending the notice. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25534 [Bug 25534] Add ability to send an email specifying a reason and store the reason when canceling a hold -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 170