July 2024 - Koha-bugs - lists.koha-community.org

[Bug 23290] XSLT system preferences allow administrators to exploit XML and XSLT vulnerabilities
by bugzilla-daemon＠bugs.koha-community.org 08 Jul '24

08 Jul '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23290 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |37252 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37252 [Bug 37252] Saving an authority record as MADS (XML) fails -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 13342] Not logged in user can place a review/comment as a deleted patron
by bugzilla-daemon＠bugs.koha-community.org 07 Jul '24

07 Jul '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13342 David Nind <david(a)davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |david(a)davidnind.com --- Comment #4 from David Nind <david(a)davidnind.com> --- Thanks for the patch Alexandre! I have tested on main before and after the patch is applied (using koha-testing-docker). If I follow the test plan, I now get this error page when I try to submit the comment (after logging out in another tab): Sorry, the requested page is not available Error 403 This message can have the following reason(s): The form submission failed (Wrong CSRF token). Try to come back, refresh the page, then try again. ... Standard page not found message Maybe the CSRF patches (bugs 34478 and 36192) have solved this for 24.05 and later? I also tested on one of the demo instances (https://koha-community.org/demo/) for Koha 23.11 and could replicate the issue. So the issue still exists. I'm not sure of the best way forward here: 1. Fix the CSRF issue (or maybe this is doing what it is supposed to do?) 2. Make this patch for 23.11 and before? 3. A combination of these? As I'm not a developer, and I don't really understand the CSRF issue, I'm probably not going to be of any help in solving the actual issue. But happy to test the patches! Note: The patch needs to follow the commit message guidelines - see https://wiki.koha-community.org/wiki/Commit_messages Post here or on the Koha Community Chat - Development channel if you need help with that (https://chat.koha-community.org/) -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 30123] New: On set library page, desk always defaults to last in list instead of desk user is signed in at
by bugzilla-daemon＠bugs.koha-community.org 07 Jul '24

07 Jul '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30123 Bug ID: 30123 Summary: On set library page, desk always defaults to last in list instead of desk user is signed in at Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Staff Client Assignee: koha-bugs(a)lists.koha-community.org Reporter: lucas(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com TO recreate: -Turn on UseCirculationDesks -Create several desks for the library you are logged in as -Set your desk to one you just created -Reload set-library.pl and notice that no matter what desk you are set as the dropdown defaults to the last one in the list It should default to your currently logged in desk -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 34

[Bug 21284] New: ILS-DI: Allow GetPatronInfo to tell if a loaned item is on hold by someone else.
by bugzilla-daemon＠bugs.koha-community.org 07 Jul '24

07 Jul '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21284 Bug ID: 21284 Summary: ILS-DI: Allow GetPatronInfo to tell if a loaned item is on hold by someone else. Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Web services Assignee: koha-bugs(a)lists.koha-community.org Reporter: matthias.meusburger(a)biblibre.com QA Contact: testopia(a)bugs.koha-community.org This patch adds two entries in the loans section of GetPatronInfo's response: - itemonhold: number of holds on this specific item. - recordonhold: number of holds on the record. It allows an ILS-DI client to know if a loaned item is already on hold by someone else, and how much holds there are. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 37

[Bug 35008] New: ILS-DI should not require authentication if OpacPublic is disabled
by bugzilla-daemon＠bugs.koha-community.org 07 Jul '24

07 Jul '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35008 Bug ID: 35008 Summary: ILS-DI should not require authentication if OpacPublic is disabled Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Web services Assignee: koha-bugs(a)lists.koha-community.org Reporter: aleisha(a)catalyst.net.nz QA Contact: testopia(a)bugs.koha-community.org The ILS-DI script should still be accessible if OpacPublic is disabled -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 26

[Bug 36590] New: check_internal_auth does not return a patron and is inconsistent with other authorization routines
by bugzilla-daemon＠bugs.koha-community.org 07 Jul '24

07 Jul '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36590 Bug ID: 36590 Summary: check_internal_auth does not return a patron and is inconsistent with other authorization routines Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: nick(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 3

[Bug 36771] New: INternal routines are ignoring the patrons found during credential checks
by bugzilla-daemon＠bugs.koha-community.org 07 Jul '24

07 Jul '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36771 Bug ID: 36771 Summary: INternal routines are ignoring the patrons found during credential checks Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Authentication Assignee: koha-bugs(a)lists.koha-community.org Reporter: nick(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: dpavlin(a)rot13.org Bug 34893 added a return of a patron object from various checkpw routines - later in checkauth, however, we fetch the patron by username or cardnumber. We should instead capture and use the patron already returned -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 3

[Bug 36575] Wrong patron can be returned for API validation route
by bugzilla-daemon＠bugs.koha-community.org 07 Jul '24

07 Jul '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36575 David Nind <david(a)davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED CC| |david(a)davidnind.com Status|Needs documenting |RESOLVED --- Comment #52 from David Nind <david(a)davidnind.com> --- No changes required to the manual. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 35942] OPAC user can enroll several times to the same club
by bugzilla-daemon＠bugs.koha-community.org 07 Jul '24

07 Jul '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35942 Phil Ringnalda <phil(a)chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |phil(a)chetcolibrary.org --- Comment #20 from Phil Ringnalda <phil(a)chetcolibrary.org> --- Probably want to wait to take it on 24.05 until you can also take bug 37031. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 35942] OPAC user can enroll several times to the same club
by bugzilla-daemon＠bugs.koha-community.org 07 Jul '24

07 Jul '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35942 Phil Ringnalda <phil(a)chetcolibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |37031 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37031 [Bug 37031] Club enrollment doesn't complete in staff interface -- You are receiving this mail because: You are watching all bug changes.

1 0