September 2024 - Koha-bugs - lists.koha-community.org

[Bug 37879] New: Whitespaces mess with report results
by bugzilla-daemon＠bugs.koha-community.org 10 Sep '24

10 Sep '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37879 Bug ID: 37879 Summary: Whitespaces mess with report results Change sponsored?: --- Product: Koha Version: 23.05 Hardware: All OS: All Status: NEW Severity: new feature Priority: P5 - low Component: Cataloging Assignee: koha-bugs(a)lists.koha-community.org Reporter: infoscienceaddict(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org CC: m.de.rooy(a)rijksmuseum.nl When a whitespace character (such as a space, tab, or line break) is accidentally added at the end of a subfield, it can cause issues in SQL reports. Specifically, it shifts all subsequent fields to the next columns, which disrupts the results. For example, if I select authid, 670$a, and 670$b from the auth_header table, and a space or tab has been added at the end of the 670$a subfield data in, say, the 3rd authority record, the resulting CSV will have an empty 670$b column. The data from 670$b will appear in the 1st column of the 4th line, the authid of the 4th record will be in the 670$a column, and so on. Therefore, would it be possible to add a tool or something that prevents catalogers from adding or pasting text that starts or ends with a whitespace character? -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 1

[Bug 37018] SQL injection using q under api/
by bugzilla-daemon＠bugs.koha-community.org 10 Sep '24

10 Sep '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37018 --- Comment #160 from Jonathan Druart <jonathan.druart(a)gmail.com> --- (In reply to Marcel de Rooy from comment #158) > Good work, here guys! > > When I am looking at the code of _validate_query, I am wondering if > constructs like > > priority => [ { '=', 2 }, { '>', 5 } ] > > are parsed correctly? > It seems that the inner hashes go recursively back into the routine, but the > operators = and > here are viewed as field names and wont be checked with > _validate_operator. Or am I misreading something? Tested on http://localhost:8080/api/v1/public/biblios/1/items With q=[{"item_id":{"<":"5"}}] It generates WHERE `itemnumber` < '5' AND `me`.`biblionumber` = '1' q=[{"item_id":[{"<":"5"},{">":"2"}]}] generates WHERE ( `itemnumber` < '5' OR `itemnumber` > '2' ) AND `me`.`biblionumber` = '1' Work as expected. Do you have another concern about it? -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 15248] Make it possible to configure duplicate check on bibliographic records
by bugzilla-daemon＠bugs.koha-community.org 10 Sep '24

10 Sep '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15248 Jonathan Druart <jonathan.druart(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=37871 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 37878] New: Rename budget_* and period_manage permissions
by bugzilla-daemon＠bugs.koha-community.org 10 Sep '24

10 Sep '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37878 Bug ID: 37878 Summary: Rename budget_* and period_manage permissions Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Acquisitions Assignee: koha-bugs(a)lists.koha-community.org Reporter: mathsabypro(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org The names of budget_* permissions and perdiod_manage are misleading. It would be easier for administrators if it matched the terminology used in staff interface. budget_add_del should be fund_add_del budget_manage should be fund_manage budget_manage_all should be fund_manage_all period_manage should be budget_manage Special case for budget_modify : see https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37877 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0

[Bug 32710] New: UI/Form/Builder/Item.t is failing randomly
by bugzilla-daemon＠bugs.koha-community.org 10 Sep '24

10 Sep '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32710 Bug ID: 32710 Summary: UI/Form/Builder/Item.t is failing randomly Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Test Suite Assignee: chris(a)bigballofwax.co.nz Reporter: jonathan.druart+koha(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org koha_1 | # Failed test 'Item types should be sorted by description and an empty entry should be shown' koha_1 | # at t/db_dependent/Koha/UI/Form/Builder/Item.t line 135. koha_1 | # Structures begin differing at: koha_1 | # $got->[8] = 'TjMK6RmH' koha_1 | # $expected->[8] = 'REF' koha_1 | # Looks like you failed 1 test of 2. koha_1 | koha_1 | # Failed test 'itemtypes' koha_1 | # at t/db_dependent/Koha/UI/Form/Builder/Item.t line 143. koha_1 | # Looks like you failed 1 test of 5. koha_1 | koha_1 | # Failed test 'authorised values' koha_1 | # at t/db_dependent/Koha/UI/Form/Builder/Item.t line 144. koha_1 | # Looks like you failed 1 test of 9. koha_1 | [15:16:06] t/db_dependent/Koha/UI/Form/Builder/Item.t Koha_Master_D10/1006 -- You are receiving this mail because: You are watching all bug changes.

1 17

[Bug 37508] SQL reports should not show patron password hash if queried
by bugzilla-daemon＠bugs.koha-community.org 10 Sep '24

10 Sep '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37508 Inkeri Hakulinen <inkeri.hakulinen+bugz(a)helsinki.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |inkeri.hakulinen+bugz@helsi | |nki.fi --- Comment #73 from Inkeri Hakulinen <inkeri.hakulinen+bugz(a)helsinki.fi> --- Is there already somewhere a ready-made sql query that will select all the other fields of borrower table except the password? I have to admit, that I've used a simple query of borrowers as a starting point for many of my reports. If you use: "SELECT * FROM borrowers WHERE cardnumber=<<cardnumber>>", it's quite a handy tool. You get the accurate list of all the fields in borrowers-table and you can easily see, how the data is stored there, compared to what you see in Koha intranet on that patron's page. Then it's easy to build more complex reports, when you can see what data is in which field, and which code number means what. I've also used my simple query to some bug tracking purporses. However, now, firstly, you have to write a pretty long SQL query compared to this old one, and then later you have to keep track of the possible changes to the fields of borrowers table (although I suppose that won't happen so often). I hope you find some solution so that "Select * from borrowers" will be possible in the future. The idea of passwords in a different table sounds ok for a main user like me. I understand the privacy concern behind this solution, but now this takes some tools away from superlibrarians who don't have direct access to the server. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 37508] SQL reports should not show patron password hash if queried
by bugzilla-daemon＠bugs.koha-community.org 10 Sep '24

10 Sep '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37508 Fridolin Somers <fridolin.somers(a)biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the| |This enhancement on reports release notes| |module prevents SQL queries | |from being run if they | |would return a password | |field from the database | |table. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 36863] CSRF Plack middleware doesn't handle the CONNECT HTTP method
by bugzilla-daemon＠bugs.koha-community.org 10 Sep '24

10 Sep '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36863 Fridolin Somers <fridolin.somers(a)biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Needs documenting --- Comment #16 from Fridolin Somers <fridolin.somers(a)biblibre.com> --- Depends on Bug 34478 not in 23.11.x -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0

[Bug 37074] Comment approval and un-approval should be CSRF-protected
by bugzilla-daemon＠bugs.koha-community.org 10 Sep '24

10 Sep '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37074 Fridolin Somers <fridolin.somers(a)biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Needs documenting --- Comment #10 from Fridolin Somers <fridolin.somers(a)biblibre.com> --- CSRF with "cud-" not backported to 23.11.x -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 15449] [Omnibus] Move stuff to the Koha namespace
by bugzilla-daemon＠bugs.koha-community.org 10 Sep '24

10 Sep '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15449 Jonathan Druart <jonathan.druart(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |37876 --- Comment #25 from Jonathan Druart <jonathan.druart(a)gmail.com> --- Bug 37876 - Move C4::Serials code to the Koha namespace Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37876 [Bug 37876] Move C4::Serials code to the Koha namespace -- You are receiving this mail because: You are watching all bug changes.

1 0