August 2024 - Koha-bugs - lists.koha-community.org

[Bug 33881] SCO/SCI user leaving the module doesn't clear session (ie JWT)
by bugzilla-daemon＠bugs.koha-community.org 15 Aug '24

15 Aug '24

1 0

[Bug 34023] HTML injection in "back to results" link from search page
by bugzilla-daemon＠bugs.koha-community.org 15 Aug '24

15 Aug '24

1 0

[Bug 22990] Add CSRF protection to boraccount, pay, suggestions and virtualshelves on staff
by bugzilla-daemon＠bugs.koha-community.org 15 Aug '24

15 Aug '24

1 0

[Bug 30524] Add base framework for dealing with CSRF in Koha
by bugzilla-daemon＠bugs.koha-community.org 15 Aug '24

15 Aug '24

1 0

[Bug 31908] New: Context accessed but not always set on mainpage.pl
by bugzilla-daemon＠bugs.koha-community.org 15 Aug '24

15 Aug '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31908 Bug ID: 31908 Summary: Context accessed but not always set on mainpage.pl Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Authentication Assignee: koha-bugs(a)lists.koha-community.org Reporter: nick(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: dpavlin(a)rot13.org To recreate: 1 - Sign in to staff interface as a user without 'catalogue' permission 2 - Get a message that you don't have access 3 - From that page, sign in as an authorised user 4 - Error: Can't use an undefined value as a HASH reference at /kohadevbox/koha/mainpage.pl line 88 I have also seen this error in production when using SSO and signing out of the staff client -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 25

[Bug 32208] New: Adjustable title
by bugzilla-daemon＠bugs.koha-community.org 15 Aug '24

15 Aug '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32208 Bug ID: 32208 Summary: Adjustable title Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: m.de.rooy(a)rijksmuseum.nl QA Contact: testopia(a)bugs.koha-community.org More info follows -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 1

[Bug 34287] New: Patron's should not be able to ask for checkoutability for different patrons
by bugzilla-daemon＠bugs.koha-community.org 15 Aug '24

15 Aug '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34287 Bug ID: 34287 Summary: Patron's should not be able to ask for checkoutability for different patrons Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: REST API Assignee: koha-bugs(a)lists.koha-community.org Reporter: tomascohen(a)gmail.com CC: tomascohen(a)gmail.com Bug 30979 implemented an endpoint for checking availability for checking out an item, and the description explains it is for checking out themselves... but it allows asking for any patron's checkoutability. I open this bug to discuss that behvior. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 12

[Bug 22068] Canceling an article request should verify the request belongs to the borrower
by bugzilla-daemon＠bugs.koha-community.org 15 Aug '24

15 Aug '24

1 0

[Bug 31219] Patron attribute types not cleaned/checked
by bugzilla-daemon＠bugs.koha-community.org 15 Aug '24

15 Aug '24

1 0

[Bug 35291] File Upload vulnerability in upload-cover-image.pl
by bugzilla-daemon＠bugs.koha-community.org 15 Aug '24

15 Aug '24

1 0