June 2025 - Koha-bugs - lists.koha-community.org

[Bug 36277] New: t/db_dependent/api/v1/transfer_limits.t is failing
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36277 Bug ID: 36277 Summary: t/db_dependent/api/v1/transfer_limits.t is failing Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Test Suite Assignee: chris(a)bigballofwax.co.nz Reporter: katrin.fischer(a)bsz-bw.de QA Contact: testopia(a)bugs.koha-community.org This failure is from the last run on master: https://jenkins.koha-community.org/job/Koha_Master/ koha_1 | # Inactivity timeout koha_1 | koha_1 | # Failed test 'POST //qBiciZO7stgLDtFSpp1ZivUHaHyn8cMP1d5DXRI:thePassword123@/api/v1/transfer_limits/batch' koha_1 | # at t/db_dependent/api/v1/transfer_limits.t line 210. koha_1 | koha_1 | # Failed test 'SWAGGER3.2.1' koha_1 | # at t/db_dependent/api/v1/transfer_limits.t line 210. koha_1 | # got: undef koha_1 | # expected: '201' koha_1 | # Looks like you failed 2 tests of 26. koha_1 | koha_1 | # Failed test 'batch_add() and batch_delete() tests' koha_1 | # at t/db_dependent/api/v1/transfer_limits.t line 269. koha_1 | # Looks like you failed 1 test of 4. -- You are receiving this mail because: You are watching all bug changes.

1 39

[Bug 36066] New: REST API: We should not allow deleting open order lines
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36066 Bug ID: 36066 Summary: REST API: We should not allow deleting open order lines Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: REST API Assignee: koha-bugs(a)lists.koha-community.org Reporter: m.de.rooy(a)rijksmuseum.nl CC: tomascohen(a)gmail.com See also bug 10869 and bug 18360. Until now we focused on not deleting order lines in the interface entirely. So it is quite strange that we allow it without any checks on the REST API. In harmony with 18360 we should check if the status is cancelled. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 37

[Bug 36103] New: "Cancel hold" link broken for item level holds
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36103 Bug ID: 36103 Summary: "Cancel hold" link broken for item level holds Change sponsored?: --- Product: Koha Version: 23.11 Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Hold requests Assignee: koha-bugs(a)lists.koha-community.org Reporter: lasse.pouru(a)koha-suomi.fi QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com 1. Open the "Holds" tab of a record with an item level hold. 2. Select a patron from the patron search. 3. Click on the "Cancel hold" link. (Link appears as it should, e.g. "modrequest.pl?CancelBiblioNumber=58&CancelBorrowerNumber=5&CancelItemnumber=125"). 4. Popup appears. Click "Confirm cancellation". 5. Page loads. Instead of the correct data for the hold to cancel, all of the values in the URL are null, i.e. "request.pl?action=cancel&borrowernumber=undefined&biblionumber=undefined&reserve_id=undefined". The hold is not cancelled. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 24

[Bug 36056] New: Clarify subpermissions check behavior in C4::Auth
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36056 Bug ID: 36056 Summary: Clarify subpermissions check behavior in C4::Auth Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: tomascohen(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Looking at C4::Auth::haspermission, it looks like it allows checking: { perm => { subperm_a => 1, subperm_b => 1 } } treating it like subperm_a AND subperm_b. But this use case is not documented. We should add tests and add it to the POD. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 15

[Bug 36010] New: Items/AutomaticItemModificationByAge.t is failing randomly
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36010 Bug ID: 36010 Summary: Items/AutomaticItemModificationByAge.t is failing randomly Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Test Suite Assignee: chris(a)bigballofwax.co.nz Reporter: jonathan.druart+koha(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Depends on: 32029 koha_1 | # Failed test 'ToggleNewStatus: conditions on biblio' koha_1 | # at t/db_dependent/Items/AutomaticItemModificationByAge.t line 356. koha_1 | # got: 'agefield_new_value' koha_1 | # expected: 'new_updated_value_biblio' koha_1 | # Looks like you failed 1 test of 20. Koha_Master_My8/1279 First failure from this one that has been pushed recently. I don't recreate locally (even using MySQL8). Maybe something to do with the age comparison if the node is slow? Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32029 [Bug 32029] Automatic item modifications by age missing biblio table -- You are receiving this mail because: You are watching all bug changes.

1 24

[Bug 39184] Server-side template injection leading to remote code execution
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39184 Wainui Witika-Park <wainuiwitikapark(a)catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldoldstable |RESOLVED Resolution|--- |FIXED --- Comment #24 from Wainui Witika-Park <wainuiwitikapark(a)catalyst.net.nz> --- Not backporting to 22.11 unless requested -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38268] New: Cancelling 'Delete list' then using 'Delete selected items' deletes list
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38268 Bug ID: 38268 Summary: Cancelling 'Delete list' then using 'Delete selected items' deletes list Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Lists Assignee: koha-bugs(a)lists.koha-community.org Reporter: phil(a)chetcolibrary.org QA Contact: testopia(a)bugs.koha-community.org CC: m.de.rooy(a)rijksmuseum.nl Steps to reproduce: 1. Add several items to a list 2. Click the checkbox for an item, then accidentally click 'Delete list' rather than 'Delete selected items' 3. Click the 'No, do not delete' button in the confirmation asking if you want to delete the list 4. Click 'Delete selected items' like you meant to 5. Click 'Yes, remove from list' in the confirmation which lists the two items you selected Expected result: the two selected items are removed from the list, leaving the rest and the list intact Actual result: the entire list is deleted -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 43

[Bug 37720] XSS (and bustage) in label creator
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37720 Wainui Witika-Park <wainuiwitikapark(a)catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Version(s)|24.11.00,24.05.04,23.11.09, |24.11.00,24.05.04,23.11.09, released in|23.05.19 |23.05.19,22.11.25 Status|Pushed to oldoldoldstable |RESOLVED -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38035] New: "sound" listed as an available language
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38035 Bug ID: 38035 Summary: "sound" listed as an available language Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: ASSIGNED Severity: major Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: jonathan.druart(a)gmail.com Reporter: jonathan.druart(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org $ koha-translate --list sound -- You are receiving this mail because: You are watching all bug changes.

1 19

[Bug 38826] New: C4::Auth::check_api_auth sometimes returns $session and sometimes returns $sessionID
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38826 Bug ID: 38826 Summary: C4::Auth::check_api_auth sometimes returns $session and sometimes returns $sessionID Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Authentication Assignee: koha-bugs(a)lists.koha-community.org Reporter: dcook(a)prosentient.com.au QA Contact: testopia(a)bugs.koha-community.org CC: dpavlin(a)rot13.org As I discovered while troubleshooting an issue with bug 37060, it appears that C4::Auth::check_api_auth sometimes returns $session and sometimes returns $sessionID. After grepping through the code, it seems that the only file that uses the $sessionID return value from C4::Auth::check_api_auth is svc/authentication so it looks like it's the only affected file. Note: $sessionID is returned on a successful login, while $session is returned when we have a cookie for an authenticated session. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 28