March 2025 - Koha-bugs - lists.koha-community.org

[Bug 29859] New: Favor iterators over as_list
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '25

06 Mar '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29859 Bug ID: 29859 Summary: Favor iterators over as_list Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: ASSIGNED Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: jonathan.druart+koha(a)gmail.com Reporter: jonathan.druart+koha(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Depends on: 29844 On bug 29844 we decided to remove wantarray from Koha::Objects->search. Reviewing the difference occurrences I found some unnecessary uses of ->as_list, where iterators should be used instead. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29844 [Bug 29844] Remove uses of wantarray in Koha::Objects -- You are receiving this mail because: You are watching all bug changes.

1 35

[Bug 27618] New: Don't show dropdown if PatronSelfRegistrationLibraryList only has one library
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '25

06 Mar '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27618 Bug ID: 27618 Summary: Don't show dropdown if PatronSelfRegistrationLibraryList only has one library Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Keywords: Academy Severity: enhancement Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: magnus(a)libriotech.no QA Contact: testopia(a)bugs.koha-community.org Depends on: 16274 If PatronSelfRegistrationLibraryList only has one library code in it, that one library is still shown as a dropdown with one choice. It would be better if the code was in a "hidden" form input and the "Home library" was just shown as text, or not shown at all. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16274 [Bug 16274] Make the selfregistration branchcode selection configurable -- You are receiving this mail because: You are watching all bug changes.

1 16

[Bug 38961] XSS in vendor search
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '25

06 Mar '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38961 Katrin Fischer <katrin.fischer(a)bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Pushed to main |RESOLVED Version(s)|25.05.00,25.05.00,24.11.02, |25.05.00,24.11.02,24.05.07, released in|24.05.07,23.11.12,22.11.24 |23.11.12,22.11.24 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38961] XSS in vendor search
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '25

06 Mar '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38961 --- Comment #17 from Katrin Fischer <katrin.fischer(a)bsz-bw.de> --- Pushed for 25.05! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38961] XSS in vendor search
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '25

06 Mar '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38961 Katrin Fischer <katrin.fischer(a)bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|25.05.00,24.11.02,24.05.07, |25.05.00,25.05.00,24.11.02, released in|23.11.12,22.11.24 |24.05.07,23.11.12,22.11.24 Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38488] Add TT filter using HTML scrubber
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '25

06 Mar '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38488 Katrin Fischer <katrin.fischer(a)bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38469] Circulation returns vulnerable to reflected XSS
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '25

06 Mar '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38469 Katrin Fischer <katrin.fischer(a)bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |RESOLVED Resolution|--- |FIXED Version(s)|25.05.00,25.05.00,24.11.02, |25.05.00,24.11.02,24.05.07, released in|24.05.07,23.11.12,22.11.24 |23.11.12,22.11.24 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38214] New: Audit use of TT url filter for uses that should be uri instead
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '25

06 Mar '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38214 Bug ID: 38214 Summary: Audit use of TT url filter for uses that should be uri instead Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Templates Assignee: oleonard(a)myacpl.org Reporter: phil(a)chetcolibrary.org QA Contact: testopia(a)bugs.koha-community.org Shame the two things look so much alike in so many fonts, when you have old eyes. The url filter is for filtering a full URL, when you don't want to escape : or // since starting a URL with http%3A%2F%2F won't work well. The uri filter is for filtering a URL parameter, where you want '/search?query=why%3F' rather than '/search?query=why?' which breaks your URL by having a second '?'. Using url when you should use uri means you are leaving &, @, /, ;, :, =, +, ? and $ unescaped when you shouldn't. In many cases, the wrong use of url is on things like biblionumber, where that doesn't result in any interesting behavior, but in other cases... you can create an authorized value category named This&That=Stuff, and when you try to add a value to it, you will add a value to the category This, and pass the parameter That with the value Stuff to the script. -- You are receiving this mail because: You are watching all bug changes.

1 8

[Bug 38467] Template::Toolkit filters can create risky Javascript when not using RFC3986
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '25

06 Mar '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38467 Katrin Fischer <katrin.fischer(a)bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|25.05.00,25.05.00,24.11.02, |25.05.00,24.11.02,24.05.07, released in|24.05.07,23.11.12,22.11.24 |23.11.12,22.11.24 Status|Pushed to main |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38454] Memory (L1) cache is not flushed before API requests
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '25

06 Mar '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38454 Katrin Fischer <katrin.fischer(a)bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |RESOLVED Version(s)|25.05.00,25.05.00,24.11.02, |25.05.00,24.11.02,24.05.07, released in|24.05.07,23.11.12,22.11.24 |23.11.12,22.11.24 Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.

1 0