June 2025 - Koha-bugs - lists.koha-community.org

[Bug 37786] members/cancel-charge.pl needs CSRF protection
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37786 Bug 37786 depends on bug 34478, which changed state. Bug 34478 Summary: Full CSRF protection https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38056] New: Search term after deleting an authority shouldn't be URI encoded
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38056 Bug ID: 38056 Summary: Search term after deleting an authority shouldn't be URI encoded Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P3 Component: MARC Authority data support Assignee: phil(a)chetcolibrary.org Reporter: phil(a)chetcolibrary.org QA Contact: testopia(a)bugs.koha-community.org Depends on: 34478 Prior to the CSRF protection, deleting an authority record from search results built up a URL for a GET, and used the uri TT filter on the value param, which is where the search term you used to find the record gets passed to the script for reloading afterward. That was fine (though the use of the html filter on the other params was a bit sketchy, given that they were being stuffed into a URL, not displayed as HTML), but when https://git.koha-community.org/Koha-community/Koha/commit/62d9f73e9e3bfe7fb… switched from a GET to a form that POSTs, it retained the same escaping, so now we have a URI encoded value being put into a form input, passed over to the script which certainly isn't expecting that, and then stuffed back into the search box and searched for literally: if you do an authority search for "professional computing" and delete one of the results, the page that loads after the deletion is a search for "professional%20computing" Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 [Bug 34478] Full CSRF protection -- You are receiving this mail because: You are watching all bug changes.

1 15

[Bug 37290] New: Deleting circulation rule for a specific branch deletes for All branches instead
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37290 Bug ID: 37290 Summary: Deleting circulation rule for a specific branch deletes for All branches instead Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: pedro.amorim(a)ptfs-europe.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 25

[Bug 37483] New: Batch extend due dates tool not working
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37483 Bug ID: 37483 Summary: Batch extend due dates tool not working Change sponsored?: --- Product: Koha Version: 24.05 Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Tools Assignee: koha-bugs(a)lists.koha-community.org Reporter: sbrown(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org The batch extend due dates tool isn't working with the following criteria in 24.05: Selected: library, patron category, and item type (one each) Due date range: input Added X number of days to existing due date Preview: same behavior whether it is deselected or selected When I click Continue, I'm returned to a blank 'Batch extend due date' screen, and due dates are not updated in patrons' accounts. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 28

[Bug 37150] New: Can't delete single title from a list using the "Remove from list" link
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37150 Bug ID: 37150 Summary: Can't delete single title from a list using the "Remove from list" link Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: ASSIGNED Severity: major Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: oleonard(a)myacpl.org QA Contact: testopia(a)bugs.koha-community.org Depends on: 34478 In the OPAC's display of titles on a list, the "Remove from link" control on individual titles tries to use a GET operation which fails because of CSRF protection. We need to POST that request. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 [Bug 34478] Full CSRF protection -- You are receiving this mail because: You are watching all bug changes.

1 18

[Bug 37039] New: Cannot request a discharge in the OPAC
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37039 Bug ID: 37039 Summary: Cannot request a discharge in the OPAC Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: ASSIGNED Severity: major Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: oleonard(a)myacpl.org QA Contact: testopia(a)bugs.koha-community.org The page needs to be updated with a valid CSRF form. -- You are receiving this mail because: You are watching all bug changes.

1 15

[Bug 36838] New: Can't approve or reject tags in the staff interface
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36838 Bug ID: 36838 Summary: Can't approve or reject tags in the staff interface Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Keywords: RM_priority Severity: major Priority: P5 - low Component: Tools Assignee: koha-bugs(a)lists.koha-community.org Reporter: oleonard(a)myacpl.org QA Contact: testopia(a)bugs.koha-community.org Depends on: 34478 The AJAX-driven operations on the tags review page are not working following the CSRF work. The console shows a 403 error and the logs show "No CSRF token passed for POST" Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 [Bug 34478] Full CSRF protection -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 12

[Bug 36995] New: Can't delete Library EAN
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36995 Bug ID: 36995 Summary: Can't delete Library EAN Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: ASSIGNED Severity: major Priority: P5 - low Component: Acquisitions Assignee: oleonard(a)myacpl.org Reporter: oleonard(a)myacpl.org QA Contact: testopia(a)bugs.koha-community.org Depends on: 34478 The CSRF update added the "cud-" prefix where it should not have. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 [Bug 34478] Full CSRF protection -- You are receiving this mail because: You are watching all bug changes.

1 15

[Bug 36877] New: Patron card creator does not work when editing layout, profile or template
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36877 Bug ID: 36877 Summary: Patron card creator does not work when editing layout, profile or template Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Tools Assignee: koha-bugs(a)lists.koha-community.org Reporter: bibliothek(a)th-wildau.de QA Contact: testopia(a)bugs.koha-community.org 1. When trying to edit a layout in patron card creator the following error is thrown on the website: WARNING: An unsupported operation was attempted on layout 20. Please have your system administrator check the error log for details. The log says: [WARN] Unsupported operation type submitted: edit at /kohadevbox/koha/patroncards/edit-layout.pl line 271. To reproduce: a) go to http://localhost:8081/cgi-bin/koha/patroncards/manage.pl?card_element=layout b) click on edit 'Test Layout' c) the above warning shows up 2. When trying to edit a template it shows an empty 'New patron card template' form 3. When trying to edit a profile it shows an empty 'New printer profile' form I think this is somehow related to Bug 34478 as all 3 scripts check for an operation $op eq 'cud-edit' but the query param is just 'edit' -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 20

[Bug 36883] New: Can't finish club enrollment in the OPAC
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36883 Bug ID: 36883 Summary: Can't finish club enrollment in the OPAC Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: OPAC Assignee: koha-bugs(a)lists.koha-community.org Reporter: oleonard(a)myacpl.org QA Contact: testopia(a)bugs.koha-community.org Depends on: 34478 When I try to enroll in a club via the OPAC the "Finish enrollment" stage doesn't work--there's a 403 error: [WARN] Programming error - No CSRF token passed for POST http://localhost:8080/opac/svc/club/enroll (referer: http://localhost:8080/cgi-bin/koha/opac-user.pl) at /kohadevbox/koha/Koha/Middleware/CSRF.pm line 82. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 [Bug 34478] Full CSRF protection -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 14