April 2025 - Koha-bugs - lists.koha-community.org

[Bug 36349] New: Login for SCO/SCI broken by CSRF
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36349 Bug ID: 36349 Summary: Login for SCO/SCI broken by CSRF Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Self checkout Assignee: koha-bugs(a)lists.koha-community.org Reporter: nick(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org bug 36102 / bug 34478 added the csrf token to opac-auth for patron login, however, it isn't used for SCO/SCI logins -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 47

[Bug 36274] New: OPAC suggestions form doesn't display
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36274 Bug ID: 36274 Summary: OPAC suggestions form doesn't display Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: katrin.fischer(a)bsz-bw.de QA Contact: testopia(a)bugs.koha-community.org When in the OPAC and I click on "New suggestion", only an empty page comes up. The form is missing. I didn't see anything in the logs. Not sure if this is related to CSRF or not? -- You are receiving this mail because: You are watching all bug changes.

1 21

[Bug 36243] New: ILL "Edit request" action is broken
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36243 Bug ID: 36243 Summary: ILL "Edit request" action is broken Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: ILL Assignee: pedro.amorim(a)ptfs-europe.com Reporter: pedro.amorim(a)ptfs-europe.com CC: david(a)davidnind.com, martin.renvoize(a)ptfs-europe.com, nugged(a)gmail.com, pedro.amorim(a)ptfs-europe.com, tomascohen(a)gmail.com, victor(a)tuxayo.net Depends on: 34478 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 [Bug 34478] Full CSRF protection -- You are receiving this mail because: You are watching all bug changes.

1 21

[Bug 36280] New: Viewing batch of staged records broken: CSRF token error
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36280 Bug ID: 36280 Summary: Viewing batch of staged records broken: CSRF token error Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Cataloging Assignee: koha-bugs(a)lists.koha-community.org Reporter: victor(a)tuxayo.net QA Contact: testopia(a)bugs.koha-community.org CC: m.de.rooy(a)rijksmuseum.nl 1. Stage a batch 2. When it's done, click on "view batch" 3. Page loads but pops an alert that says "403: Forbidden" and table stays empty network tool show an XHR to /cgi-bin/koha/tools/batch_records_ajax.pl that returns 403. The content can be save in an HTML file and opened to show a page that says: > An error has occurred! > Error 403 > Programming error - No CSRF token passed for POST Going to "Manage staged MARC records" and view an existing batch has the same outcome. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 5

[Bug 36326] New: Biblio detail view - Deletion of items is broken
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36326 Bug ID: 36326 Summary: Biblio detail view - Deletion of items is broken Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Cataloging Assignee: koha-bugs(a)lists.koha-community.org Reporter: pedro.amorim(a)ptfs-europe.com QA Contact: testopia(a)bugs.koha-community.org CC: m.de.rooy(a)rijksmuseum.nl Blocks: 36192 k-t-d 1) visit a biblio: http://localhost:8081/cgi-bin/koha/catalogue/detail.pl?biblionumber=230 2) Tick 2 checkboxes on the left most column of the items table 3) Click the " Delete selected items" action. 4) Notice you are taken to http://localhost:8081/cgi-bin/koha/tools/batchMod.pl?op=show&del=1&itemnumb… 5) Notice the page is blank Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 [Bug 36192] [OMNIBUS] CSRF Protection for Koha -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 32

[Bug 36219] New: State parameter broken for OIDC/Oauth
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36219 Bug ID: 36219 Summary: State parameter broken for OIDC/Oauth Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: blocker Priority: P5 - low Component: Authentication Assignee: koha-bugs(a)lists.koha-community.org Reporter: dcook(a)prosentient.com.au QA Contact: testopia(a)bugs.koha-community.org CC: dpavlin(a)rot13.org Bug 34478 accidentally removed the csrf token that functions as the state parameter in Koha/REST/V1/OAuth/Client.pm, which has broken the OIDC/Oauth SSO. Easy fix though, and should only be relevant for master at this point. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 13

[Bug 36237] New: Improve set-library UI after 34478
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36237 Bug ID: 36237 Summary: Improve set-library UI after 34478 Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Staff interface Assignee: koha-bugs(a)lists.koha-community.org Reporter: lucas(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Bug 34478 added a new step when setting a library, desk, or register. I could use a few UI improvements. To recreate: 1. Enable UseCirculationDesks, make some desks via UseCashRegisters > Circulation desks 2. Enable UseCashRegisters, make some registers via UseCashRegisters > Registers 3. Go to set library page. Try changing the branch, desk, or register. 4. See that UI could use some improvements. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 18

[Bug 36241] New: ILL Batches are broken
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36241 Bug ID: 36241 Summary: ILL Batches are broken Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: ILL Assignee: koha-bugs(a)lists.koha-community.org Reporter: pedro.amorim(a)ptfs-europe.com CC: pedro.amorim(a)ptfs-europe.com Depends on: 34478 Caused by bash op_must_start_with_cud-perl.sh Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 [Bug 34478] Full CSRF protection -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 18

[Bug 36193] New: CSRF - Code review missed
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 Bug ID: 36193 Summary: CSRF - Code review missed Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: critical Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: nick(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org This bug is for tracking follow-ups missed in the initial review. Please see the "Code review missed" section on the framapad here: https://annuel.framapad.org/p/koha_34478_remaining Additional entries can be added there, and should be crossed out when completed Patches should be attached here This bug can be closed when that section of the pad is empty -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 36

[Bug 36190] New: op param for stateful requests must start with 'cud-'
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 Bug ID: 36190 Summary: op param for stateful requests must start with 'cud-' Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: jonathan.druart+koha(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org This is enforced in Koha::Middleware::CSRF but the tests is not catching incorrect occurrences. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 30