February 2025 - Koha-bugs - lists.koha-community.org

[Bug 37826] New: Templates that use the variable script_name should be called by scripts that set it
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37826 Bug ID: 37826 Summary: Templates that use the variable script_name should be called by scripts that set it Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Templates Assignee: oleonard(a)myacpl.org Reporter: phil(a)chetcolibrary.org QA Contact: testopia(a)bugs.koha-community.org We have templates that use the variable script_name for the path and filename of the script that called them, particularly as the action attribute of forms that call back to it. We have scripts that set the template->param script_name to their path and filename. What we don't have is a 1:1 match between templates and scripts, as the failure mode in bug 37797 comment 1 shows. If you set action="[% script_name %]" when it isn't defined, you get action="", which may work for years if every form submitted to that script is a POST, but once someone changes one to a get, action="" will POST to aqbudgetperiods.pl?op=delete_confirm&budget_period_id=2 and both the things in the POST body and also things in the query string will wind up being sent to the script. What I don't have is any good idea how to find templates using unset script_name, short of just brute force looking at every one. -- You are receiving this mail because: You are watching all bug changes.

1 13

[Bug 38395] New: Title is not displayed in hold history when biblio is deleted
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38395 Bug ID: 38395 Summary: Title is not displayed in hold history when biblio is deleted Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Patrons Assignee: koha-bugs(a)lists.koha-community.org Reporter: andrew(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com, nick(a)bywatersolutions.com Depends on: 30648 Bug 30648 made Koha retain deleted_biblionumber in reserves and old_reserves, but did not make Koha use that deleted_biblionumber to display a title in holds history. To recreate: - place a hold - cancel the hold - look in patron hold history, see the title - delete the biblio - reload patron hold history, see "No bibliographic record" - use a report to look at your hold in old_reserves, confirm your deleted biblionumber is in the table Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30648 [Bug 30648] Title is lost in holds history when bibliographic record is deleted -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 26

[Bug 35560] New: Use the REST API for holds history
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35560 Bug ID: 35560 Summary: Use the REST API for holds history Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Hold requests Assignee: koha-bugs(a)lists.koha-community.org Reporter: jonathan.druart+koha(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Blocks: 34832 On members/holdshistory.pl Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34832 [Bug 34832] [OMNIBUS] API all the Tables! -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 91

[Bug 38921] New: Remove unused href from Cancel hold link
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38921 Bug ID: 38921 Summary: Remove unused href from Cancel hold link Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: trivial Priority: P5 - low Component: Templates Assignee: oleonard(a)myacpl.org Reporter: phil(a)chetcolibrary.org QA Contact: testopia(a)bugs.koha-community.org Depends on: 34478 We use koha-tmpl/intranet-tmpl/prog/en/includes/holds_table.inc to display the list of existing holds in reserve/request.pl when you are placing a hold. The cancel button-links are JavaScript-only, showing a confirm modal and then POSTing a form from there, since the op is cud-cancel and has to be a POST. But we left behind a pre-CSRF href attribute which is a double false-positive for me, since it has both op=cancel and uses the Template Toolkit html filter rather than the uri filter for things inserted in a URL parameter. You can see that it doesn't do anything by right-clicking and opening it in a new tab - there's no op named cancel, so it just displays the existing holds and lets you add one, repeating the page you opened the link from, only with garbage after the request.pl? in your URL. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 [Bug 34478] Full CSRF protection -- You are receiving this mail because: You are watching all bug changes.

1 14

[Bug 20965] New: Batch patron anonymization logic is flawed
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20965 Bug ID: 20965 Summary: Batch patron anonymization logic is flawed Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Tools Assignee: koha-bugs(a)lists.koha-community.org Reporter: martin.renvoize(a)ptfs-europe.com QA Contact: testopia(a)bugs.koha-community.org There are two issues here: 1) The tool suggests you can limit by library and checkout date but in fact, the library is not the patrons' library but the library the items were issued at. This is not clear from the UI. 2) When it comes to the actual anonymisation, although we've got a filtered list of Patrons by issues before X and at Library, we then delete ALL issues before X by any of the Patrons selected by the previous query, regardless of which library the checkout took place and thus we ignore the selected Library. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 6

[Bug 37512] New: Add a function to reset login attempts
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37512 Bug ID: 37512 Summary: Add a function to reset login attempts Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: baptiste.wojtkowski(a)biblibre.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com When a user tries to much login attempts, they are blocked. There are two ways to unlock the user: 1 - Change the database 2 - Reset the password There is currently no option to simply remove the lock for a blocked account. In BZ 25947 (https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25947) we added a button to reset the password and another to simply reset the loginattempts. This bug has been created to split the two improvements. This bugs containts the improvements related to the button to reset loginattempts -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 50

[Bug 36085] New: Protected Status should come with a permission
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36085 Bug ID: 36085 Summary: Protected Status should come with a permission Change sponsored?: --- Product: Koha Version: 23.11 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Patrons Assignee: koha-bugs(a)lists.koha-community.org Reporter: kelly(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com With the new enhancement, 26170, add protected status to patrons, this allows any patron to be updated/edited to be a 'protected patron'. Staff with 'edit borrowers' permission will be able to update this status. I believe there should be a permission to allow for this field to be updated/edited within Koha. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 45

[Bug 34438] New: OPAC self registration form does not include lang ( Preferred language for notices ) field
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34438 Bug ID: 34438 Summary: OPAC self registration form does not include lang ( Preferred language for notices ) field Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: lucas(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org To recreate: 1. Install a language pack ( sudo koha-translate -i es-ES ) 2. Turn on the system preference TranslateNotices 3. The lang field now appears when registering a patron from the staff interface but not on the OPAC self registration form. -- You are receiving this mail because: You are watching all bug changes.

1 46

[Bug 28548] New: Clarify "frombranch" flag in overdue_notices.pl
by bugzilla-daemon＠bugs.koha-community.org 25 Feb '26

25 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28548 Bug ID: 28548 Summary: Clarify "frombranch" flag in overdue_notices.pl Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Command-line Utilities Assignee: koha-bugs(a)lists.koha-community.org Reporter: andrew(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: robin(a)catalyst.net.nz The cronjob overdue_notices.pl includes this text in its options: " --frombranch Set the from address for the notice to one of 'item-homebranch' or 'item-issuebranch'." While that text suggests that the --frombranch flag will only change which branch's address info is populated in overdue notices, this flag actually controls which branch's triggers will be used as well as which branch's notice content will be used. We should change that text to: Set the branch to use when selecting triggers and populating addresses. Available options are 'item-homebranch' or 'item-issuebranch'. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 6

[Bug 30895] New: Electronic acknowledgement for certain loans
by bugzilla-daemon＠bugs.koha-community.org 25 Feb '26

25 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30895 Bug ID: 30895 Summary: Electronic acknowledgement for certain loans Change sponsored?: --- Product: Koha Version: 21.11 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Patrons Assignee: koha-bugs(a)lists.koha-community.org Reporter: cbrannon(a)cdalibrary.org QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com It would be beneficial to libraries that loan non-traditional items that carry some risk, such as in a library of things that loans tools, for example, to have some form of electronic acknowledgement of the risk and waiving rights associated with said risks. In particular, it would be great if there were some way to create a Patron Attribute Type that the patron has the ability to check or fill out, that would allow the loan of the above items. So, in general, if this patron attribute type is filled out or checked, specific circulation rules go into affect and allow the patron to check out or place on hold specified items. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 1