October 2025 - Koha-bugs - lists.koha-community.org

[Bug 34478] Full CSRF protection
by bugzilla-daemon＠bugs.koha-community.org 23 Oct '25

23 Oct '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 Martin Renvoize (ashimema) <martin.renvoize(a)openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on|30524 | Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30524 [Bug 30524] Add base framework for dealing with CSRF in Koha -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 36246] New: Have a centralized method for submitting a form via a link
by bugzilla-daemon＠bugs.koha-community.org 23 Oct '25

23 Oct '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36246 Bug ID: 36246 Summary: Have a centralized method for submitting a form via a link Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: nick(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org With new CSRF protection we have a fair number places where action buttons have become full forms, or links need to use JS to submit a form. We have generally agreed that the form should be in the page, and the js can add the necessary values for POSTing I think we should go a step further and have a class that can be used to submit a form via a link with data elements, i.e. <a class="btn btn-default btn-xs submit-form-link" href="#" data-adjustment_id="[% adjustment.adjustment_id | html %]" data-invoiceid="[% invoiceid | html %]" data-action="invoice.pl" data-method="post" data-op="cud-del_adj" data-confirmation="confirm_delete_adjustment"> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 38

[Bug 37040] New: ErrorDocument accidentally setting off CSRF
by bugzilla-daemon＠bugs.koha-community.org 23 Oct '25

23 Oct '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37040 Bug ID: 37040 Summary: ErrorDocument accidentally setting off CSRF Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: dcook(a)prosentient.com.au QA Contact: testopia(a)bugs.koha-community.org As Michal Kula noted on Mattermost, trying to log into http://localhost:8081/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=99… in main will yield a bizarre HTTP response that includes headers for a 403 response and a 200 response... This is due to a bug in addbiblio.pl, but it's also causing the CSRF to fire for the ErrorDocument, so we need to fix that. I have an idea for it... -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 27

[Bug 30093] New: Rewrite some of the patron searches when placing a hold with the REST API route
by bugzilla-daemon＠bugs.koha-community.org 23 Oct '25

23 Oct '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30093 Bug ID: 30093 Summary: Rewrite some of the patron searches when placing a hold with the REST API route Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: ASSIGNED Severity: enhancement Priority: P5 - low Component: Patrons Assignee: jonathan.druart+koha(a)gmail.com Reporter: jonathan.druart+koha(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com -- You are receiving this mail because: You are watching all bug changes.

1 57

[Bug 30074] New: Missing extended_attributes relationship in DBIC schema
by bugzilla-daemon＠bugs.koha-community.org 23 Oct '25

23 Oct '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30074 Bug ID: 30074 Summary: Missing extended_attributes relationship in DBIC schema Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: ASSIGNED Severity: enhancement Priority: P5 - low Component: REST API Assignee: jonathan.druart+koha(a)gmail.com Reporter: jonathan.druart+koha(a)gmail.com CC: tomascohen(a)gmail.com REST API route /patrons has extended_attributes available (x-koha-embed) but it's actually not working. GET /api/v1/patrons: unhandled exception (Koha::Exceptions::BadParameter)<<Cannot find Koha::Object class for extended_attributes>> Koha::REST::Plugin::Exceptions::__ANON__ /kohadevbo x/koha/Koha/REST/Plugin/Exceptions.pm (73) It's missing the relationship named "extended_attributes". -- You are receiving this mail because: You are watching all bug changes.

1 18

[Bug 30639] New: Patron search does not find patrons if passed first and last name
by bugzilla-daemon＠bugs.koha-community.org 23 Oct '25

23 Oct '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30639 Bug ID: 30639 Summary: Patron search does not find patrons if passed first and last name Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: nick(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org Search for: "edna acosta" OR "henry acevedo" OR you favorite default patron No results! The query is search for both terms in each field: i.e. firstname LIKE 'edna acosta' -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 25

[Bug 30063] New: Make the main patron search use the /patrons REST API route
by bugzilla-daemon＠bugs.koha-community.org 23 Oct '25

23 Oct '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30063 Bug ID: 30063 Summary: Make the main patron search use the /patrons REST API route Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: ASSIGNED Severity: enhancement Priority: P5 - low Component: Patrons Assignee: jonathan.druart+koha(a)gmail.com Reporter: jonathan.druart+koha(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com Depends on: 30055 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30055 [Bug 30055] Rewrite some of the patron searches to make them use the REST API routes -- You are receiving this mail because: You are watching all bug changes.

1 122

[Bug 35197] New: Expose additional fields through REST API
by bugzilla-daemon＠bugs.koha-community.org 23 Oct '25

23 Oct '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35197 Bug ID: 35197 Summary: Expose additional fields through REST API Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: REST API Assignee: koha-bugs(a)lists.koha-community.org Reporter: pedro.amorim(a)ptfs-europe.com CC: tomascohen(a)gmail.com Blocks: 32751 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32751 [Bug 32751] [Omnibus] Extend, improve and standardize additional fields -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 63

[Bug 37262] New: api/v1/extended_attribute_types does not filter additional fields for unmapped tablenames
by bugzilla-daemon＠bugs.koha-community.org 23 Oct '25

23 Oct '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37262 Bug ID: 37262 Summary: api/v1/extended_attribute_types does not filter additional fields for unmapped tablenames Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: REST API Assignee: koha-bugs(a)lists.koha-community.org Reporter: pedro.amorim(a)ptfs-europe.com QA Contact: testopia(a)bugs.koha-community.org CC: tomascohen(a)gmail.com Depends on: 35197, 37261 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35197 [Bug 35197] Expose additional_field definitions through REST API https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37261 [Bug 37261] api/v1/extended_attribute_types does not return additional fields for unmapped tablenames -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 26

[Bug 40177] New: Add maxLength to the library definition
by bugzilla-daemon＠bugs.koha-community.org 23 Oct '25

23 Oct '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40177 Bug ID: 40177 Summary: Add maxLength to the library definition Change sponsored?: --- Product: Koha Version: 24.11 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: REST API Assignee: koha-bugs(a)lists.koha-community.org Reporter: jonathan.druart(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org CC: tomascohen(a)gmail.com -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 25