October 2025 - Koha-bugs - lists.koha-community.org

[Bug 40748] Remote-Code-Execution (RCE) in update_social_data.pl
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '25

08 Oct '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40748 Fridolin Somers <fridolin.somers(a)biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|25.11.00,25.05.04,24.11.09, |25.11.00,25.05.04,24.11.09, released in|24.05.12 |24.05.12,22.11.31 Status|Pushed to main |Needs documenting -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 40766] Reflected XSS in set-library.pl
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '25

08 Oct '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40766 Fridolin Somers <fridolin.somers(a)biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Needs documenting Version(s)|25.11.00,25.05.04,24.11.09, |25.11.00,25.05.04,24.11.09, released in|24.05.12 |24.05.12,22.11.31 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 40766] Reflected XSS in set-library.pl
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '25

08 Oct '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40766 Fridolin Somers <fridolin.somers(a)biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the|25.11.00,25.05.04,24.11.09, | release notes|24.05.12 | Version(s)| |25.11.00,25.05.04,24.11.09, released in| |24.05.12 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 40579] CSV formula injection protection
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '25

08 Oct '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40579 Fridolin Somers <fridolin.somers(a)biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Needs documenting -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 40538] XSS in hold suspend modal in staff interface
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '25

08 Oct '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40538 Fridolin Somers <fridolin.somers(a)biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldoldoldstable |Needs documenting -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 40538] XSS in hold suspend modal in staff interface
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '25

08 Oct '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40538 Fridolin Somers <fridolin.somers(a)biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldoldstable |Pushed to oldoldoldstable -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 40538] XSS in hold suspend modal in staff interface
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '25

08 Oct '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40538 Fridolin Somers <fridolin.somers(a)biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldstable |Pushed to oldoldstable -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 40538] XSS in hold suspend modal in staff interface
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '25

08 Oct '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40538 Fridolin Somers <fridolin.somers(a)biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Pushed to oldstable -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 40538] XSS in hold suspend modal in staff interface
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '25

08 Oct '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40538 Fridolin Somers <fridolin.somers(a)biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Pushed to stable -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 37430] New: (Bug 33407 follow-up) ISBD punctuation removal in ES searches
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '25

08 Oct '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37430 Bug ID: 37430 Summary: (Bug 33407 follow-up) ISBD punctuation removal in ES searches Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: trivial Priority: P5 - low Component: Searching - Elasticsearch Assignee: januszop(a)gmail.com Reporter: januszop(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org CC: nick(a)bywatersolutions.com Depends on: 33407 Tiny adjustment for very special and malicious cases needed in the Koha::SearchEngine::Elasticsearch::QueryBuilder::clean_search_term. Extended unit tests should be added following Nick's suggestions in Bug 33407 discussion. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33407 [Bug 33407] With ES and QueryAutoTruncate on, a search containing ISBD punctuation returns no results -- You are receiving this mail because: You are watching all bug changes.

1 14