April 2025 - Koha-bugs - lists.koha-community.org

[Bug 29914] New: check_cookie_auth not strict enough
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29914 Bug ID: 29914 Summary: check_cookie_auth not strict enough Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: ASSIGNED Severity: critical Priority: P5 - low Component: Authentication Assignee: jonathan.druart+koha(a)gmail.com Reporter: jonathan.druart+koha(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org CC: dpavlin(a)rot13.org This has been found on bug 28786 comment 91. check_cookie_auth is assuming that the user is authenticated if a cookie exists and that the login/username exists in the DB. This is very bad! I have no idea what are the possible breaches it opens, but there are certainly some. -- You are receiving this mail because: You are watching all bug changes.

1 11

[Bug 30207] New: Librarians with only "place_holds" permission can no longer update hold pickup locations
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Bug ID: 30207 Summary: Librarians with only "place_holds" permission can no longer update hold pickup locations Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Hold requests Assignee: koha-bugs(a)lists.koha-community.org Reporter: kyle(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Bug 29540 increased the flags required to for modreserve.pl, but in doing so created a situation where a library can select a different pickup location for a hold, but upon clicking the "Update hold(s)" button, will be logged out due to having insufficient permissions for modreserve.pl. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 36

[Bug 30199] New: self checkout login by cardnumber is broken if you input a non-existent cardnumber
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30199 Bug ID: 30199 Summary: self checkout login by cardnumber is broken if you input a non-existent cardnumber Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Self checkout Assignee: koha-bugs(a)lists.koha-community.org Reporter: lucas(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org To recreate: 1. Set SelfCheckoutByLogin to 'cardnumber'. 2. Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 3. Enter an invalid carnumber like 'thisisabadcardnumber' 4. See the appropriate message "Sorry The userid thisisabadcardnumber was not found in the database. Please try again." 5. Try again with a different cardnumber and notice the same exact error message including the 'thisisabadcardnumber' cardnumber. 6. The only thing that solves it for me is to direct my browser to this URL: http://localhost:8080/cgi-bin/koha/sco/sco-main.pl?op=logout That properly logs me out and allows me to input a new cardnumber. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 30

[Bug 28904] New: Update information on Newsletter editor on about page
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28904 Bug ID: 28904 Summary: Update information on Newsletter editor on about page Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: trivial Priority: P5 - low Component: About Assignee: koha-bugs(a)lists.koha-community.org Reporter: katrin.fischer(a)bsz-bw.de QA Contact: testopia(a)bugs.koha-community.org We should add Chad Rosenburg and Michal Kuhn with their roles as newsletter editors to the about page. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 35

[Bug 30808] New: Release team 22.11
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30808 Bug ID: 30808 Summary: Release team 22.11 Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: About Assignee: koha-bugs(a)lists.koha-community.org Reporter: martin.renvoize(a)ptfs-europe.com QA Contact: testopia(a)bugs.koha-community.org CC: david(a)davidnind.com, dcook(a)prosentient.com.au, fridolin.somers(a)biblibre.com, jonathan.druart+koha(a)gmail.com, katrin.fischer(a)bsz-bw.de, kyle(a)bywatersolutions.com, m.de.rooy(a)rijksmuseum.nl, testopia(a)bugs.koha-community.org, victor(a)tuxayo.net, wainuiwitikapark(a)catalyst.net.nz Depends on: 29300 Add the next release team :) Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29300 [Bug 29300] Release team 22.05 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 25

[Bug 29300] New: Release team 22.05
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29300 Bug ID: 29300 Summary: Release team 22.05 Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: About Assignee: koha-bugs(a)lists.koha-community.org Reporter: martin.renvoize(a)ptfs-europe.com QA Contact: testopia(a)bugs.koha-community.org CC: dcook(a)prosentient.com.au, fridolin.somers(a)biblibre.com, jonathan.druart+koha(a)gmail.com, katrin.fischer(a)bsz-bw.de, m.de.rooy(a)rijksmuseum.nl, testopia(a)bugs.koha-community.org, victor(a)tuxayo.net, wainuiwitikapark(a)catalyst.net.nz Add the next release team :) -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 36

[Bug 28960] New: EDI transfer_items uses a relationship where it's looking for a field
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28960 Bug ID: 28960 Summary: EDI transfer_items uses a relationship where it's looking for a field Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Acquisitions Assignee: koha-bugs(a)lists.koha-community.org Reporter: martin.renvoize(a)ptfs-europe.com QA Contact: testopia(a)bugs.koha-community.org In Koha::EDI::transfer_items we do a branchcode comparison. Unfortunately, the comparison is called against a DBIx::Class relationship accessor instead of explicitly calling get_column to get the corresponding field value instead of a full fledged DBIx::Class::Result object. This can cause issues in proceedings. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 22

[Bug 28802] New: Untranslatable strings in browser.js
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28802 Bug ID: 28802 Summary: Untranslatable strings in browser.js Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Staff Client Assignee: koha-bugs(a)lists.koha-community.org Reporter: fridolin.somers(a)biblibre.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com File koha-tmpl/intranet-tmpl/js/browser.js is not parsed by translation process, which uses koha-tmpl/intranet-tmpl/prog/js/**/*.js We must move it to prog/js. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 22

[Bug 28644] New: Can't call method "borrowernumber" on an undefined value at C4/Reserves.pm line 607
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28644 Bug ID: 28644 Summary: Can't call method "borrowernumber" on an undefined value at C4/Reserves.pm line 607 Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Hold requests Assignee: koha-bugs(a)lists.koha-community.org Reporter: m.de.rooy(a)rijksmuseum.nl QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Got this one under 19.11 on line 521 Looks like someone tried to cancel an already cancelled hold from the opac (in the user menu). Trivial fix. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 19

[Bug 28462] New: TT tag on several lines break the translator tool
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28462 Bug ID: 28462 Summary: TT tag on several lines break the translator tool Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: critical Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: jonathan.druart+koha(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org In opac-advsearch.tt -- You are receiving this mail because: You are watching all bug changes.

1 34