February 2025 - Koha-bugs - lists.koha-community.org

[Bug 38338] New: Add support for XOAUTH2 authentication for SMTP servers
by bugzilla-daemon＠bugs.koha-community.org 09 Jul '26

09 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38338 Bug ID: 38338 Summary: Add support for XOAUTH2 authentication for SMTP servers Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: dcook(a)prosentient.com.au QA Contact: testopia(a)bugs.koha-community.org Both Google and Microsoft have been pushing XOAUTH2 for SMTP AUTH over the traditional basic username/password authentication for some time now and we haven't really had a good answer for Koha admins. For SMTP connections in Koha, we use Email::Sender::Transport::SMTP::Persistent which uses Authen::SASL which uses libsasl2 (if available) or a pure Perl fallback. Out of the box, neither libsasl2 nor Authen::SASL::Perl provides XOAUTH2 support. However, there are a number of SASL plugins out there. I'll explain more in the comments. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 116

[Bug 34755] New: Error authenticating to external OpenID Connect (OIDC) identity provider : wrong_csrf_token
by bugzilla-daemon＠bugs.koha-community.org 09 Jul '26

09 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34755 Bug ID: 34755 Summary: Error authenticating to external OpenID Connect (OIDC) identity provider : wrong_csrf_token Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: critical Priority: P5 - low Component: Authentication Assignee: koha-bugs(a)lists.koha-community.org Reporter: michaela.sieber(a)kit.edu QA Contact: testopia(a)bugs.koha-community.org CC: dpavlin(a)rot13.org Since update to koha 23.05 we have an issue with OpenID Connect Authentication. When using OIDC authentication we often (but not always) get the error message "There was an error authenticating to external identity provider wrong_csrf_token" in OPAC or staff. If the user clicks once again on the login button he is logged in his opac account. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 68

[Bug 37741] New: Koha errors on page (e.g. 404) cause incorrect CSRF errors
by bugzilla-daemon＠bugs.koha-community.org 09 Jul '26

09 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37741 Bug ID: 37741 Summary: Koha errors on page (e.g. 404) cause incorrect CSRF errors Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: critical Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: dcook(a)prosentient.com.au QA Contact: testopia(a)bugs.koha-community.org To reproduce: 1. Set syspref IntranetFavicon to http://localhost:8081/cgi-bin/koha/bad.jpg 2. Open browser developer tools 3. Go to http://localhost:8081/cgi-bin/koha/mainpage.pl 4. Open the Network tab, disable the cache, and shift refresh 5. Notice that bad.jpg fails to load with a 404 6. Try to login to Koha 7. Confirm 403 error 8. If you look at the cookies sent/received by mainpage.pl on the first load, the bad.jpg load, and the second mainpage.pl load, you'll see that first mainpage.pl returns a cookie, which is used by bad.jpg, which returns a new cookie, which is used by the second mainpage.pl However, the CSRF token submitted with the second mainpage.pl is tied to the cookie from the first mainpage.pl load! It'll never work! The solution is to stop 404.pl from returning a 404.pl cookie. After all, 404.pl shouldn't be creating/updating a cookie. It's just supposed to return a pretty 404 document. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 21

[Bug 36934] New: "Wrong CSRF" after login rejection (StaffLoginRestrictBranchByIP)
by bugzilla-daemon＠bugs.koha-community.org 09 Jul '26

09 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36934 Bug ID: 36934 Summary: "Wrong CSRF" after login rejection (StaffLoginRestrictBranchByIP) Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Staff interface Assignee: koha-bugs(a)lists.koha-community.org Reporter: jonathan.druart(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Depends on: 36933 Found when testing StaffLoginRestrictBranchByIP: * Turn on StaffLoginRestrictBranchByIP * Set CPL's IP to 1.2.3.4 * Go to the staff login screen and try to connect to CPL => Error: Autolocation is switched on and you are logging in with an IP address that doesn't match your library. (OK) * Pick another library => 403 (KO) -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 8

[Bug 29720] New: Allow per-user customization of table settings
by bugzilla-daemon＠bugs.koha-community.org 08 Jul '26

08 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29720 Bug ID: 29720 Summary: Allow per-user customization of table settings Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Staff Client Assignee: koha-bugs(a)lists.koha-community.org Reporter: andrew(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Table settings are currently global. Per-user customization would be great! -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 4

[Bug 29281] New: Allow per-user configuration of table settings and default sort orders
by bugzilla-daemon＠bugs.koha-community.org 08 Jul '26

08 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29281 Bug ID: 29281 Summary: Allow per-user configuration of table settings and default sort orders Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Staff Client Assignee: koha-bugs(a)lists.koha-community.org Reporter: andrew(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Different users will have different needs for what's shown in any given table in the staff interface. Table settings only allow things to be shown/hidden systemwide. It'd be great to have a way for individual users to pick their own defaults. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 3

[Bug 35380] New: PUT /biblios/:biblio_id doesn't respect overlay rules
by bugzilla-daemon＠bugs.koha-community.org 08 Jul '26

08 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35380 Bug ID: 35380 Summary: PUT /biblios/:biblio_id doesn't respect overlay rules Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: REST API Assignee: koha-bugs(a)lists.koha-community.org Reporter: tomascohen(a)gmail.com CC: tomascohen(a)gmail.com Based on bug 31801#c5, this endpoint should, at least, respect the any default rule as defined in the MARC overlay rules. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 98

[Bug 29168] New: Disable "Request article" links when limit is reached
by bugzilla-daemon＠bugs.koha-community.org 08 Jul '26

08 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29168 Bug ID: 29168 Summary: Disable "Request article" links when limit is reached Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: jonathan.druart+koha(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Since bug 27945 we can limit article request per patron's category. However the "request article" links (detail and search views) are still active. We could disable them and add a tooltip. -- You are receiving this mail because: You are watching all bug changes.

1 34

[Bug 35553] New: No RENEWAL notice sent if renewed via OPAC without an all libraries notice
by bugzilla-daemon＠bugs.koha-community.org 08 Jul '26

08 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35553 Bug ID: 35553 Summary: No RENEWAL notice sent if renewed via OPAC without an all libraries notice Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Notices Assignee: koha-bugs(a)lists.koha-community.org Reporter: lucas(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org To recreate: 1. Turn on RenewalSendNotice 2. In k-t-d delete copy the 'All libraries' RENEWAL notice to CPL. 3. Delete the all libraries notice. 4. Checkout an item from CPL, to a CPL patron, while logged in as CPL. 5. Make sure that patron's message pref are set so they will receive a RENEWAL notice. 6. Go to the OPAC account for that patron and renew the item. 7. The item is renewed but no notice is sent. 8. Check the logs and see something like: No circulation RENEWAL letter transported by email at /kohadevbox/koha/C4/Letters.pm line 603. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 2

[Bug 38050] New: Add REST endpoints for working with "lists"/"virtual shelves"
by bugzilla-daemon＠bugs.koha-community.org 08 Jul '26

08 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38050 Bug ID: 38050 Summary: Add REST endpoints for working with "lists"/"virtual shelves" Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: REST API Assignee: koha-bugs(a)lists.koha-community.org Reporter: martin.renvoize(a)ptfs-europe.com QA Contact: testopia(a)bugs.koha-community.org CC: tomascohen(a)gmail.com We don't yet expose the lists functionality over API's, this would be a beneficial enhancement both for internal use and thrid party integrations wishing to integrate with this functionality. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 71