June 2025 - Koha-bugs - lists.koha-community.org

[Bug 36219] New: State parameter broken for OIDC/Oauth
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36219 Bug ID: 36219 Summary: State parameter broken for OIDC/Oauth Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: blocker Priority: P5 - low Component: Authentication Assignee: koha-bugs(a)lists.koha-community.org Reporter: dcook(a)prosentient.com.au QA Contact: testopia(a)bugs.koha-community.org CC: dpavlin(a)rot13.org Bug 34478 accidentally removed the csrf token that functions as the state parameter in Koha/REST/V1/OAuth/Client.pm, which has broken the OIDC/Oauth SSO. Easy fix though, and should only be relevant for master at this point. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 13

[Bug 36237] New: Improve set-library UI after 34478
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36237 Bug ID: 36237 Summary: Improve set-library UI after 34478 Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Staff interface Assignee: koha-bugs(a)lists.koha-community.org Reporter: lucas(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Bug 34478 added a new step when setting a library, desk, or register. I could use a few UI improvements. To recreate: 1. Enable UseCirculationDesks, make some desks via UseCashRegisters > Circulation desks 2. Enable UseCashRegisters, make some registers via UseCashRegisters > Registers 3. Go to set library page. Try changing the branch, desk, or register. 4. See that UI could use some improvements. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 18

[Bug 36241] New: ILL Batches are broken
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36241 Bug ID: 36241 Summary: ILL Batches are broken Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: ILL Assignee: koha-bugs(a)lists.koha-community.org Reporter: pedro.amorim(a)ptfs-europe.com CC: pedro.amorim(a)ptfs-europe.com Depends on: 34478 Caused by bash op_must_start_with_cud-perl.sh Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 [Bug 34478] Full CSRF protection -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 18

[Bug 36193] New: CSRF - Code review missed
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36193 Bug ID: 36193 Summary: CSRF - Code review missed Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: critical Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: nick(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org This bug is for tracking follow-ups missed in the initial review. Please see the "Code review missed" section on the framapad here: https://annuel.framapad.org/p/koha_34478_remaining Additional entries can be added there, and should be crossed out when completed Patches should be attached here This bug can be closed when that section of the pad is empty -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 36

[Bug 36190] New: op param for stateful requests must start with 'cud-'
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36190 Bug ID: 36190 Summary: op param for stateful requests must start with 'cud-' Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: jonathan.druart+koha(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org This is enforced in Koha::Middleware::CSRF but the tests is not catching incorrect occurrences. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 30

[Bug 36195] New: CSRF - testing reports
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36195 Bug ID: 36195 Summary: CSRF - testing reports Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: critical Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: nick(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org This bug is for tracking follow-ups missed in the initial review. Please see the "testing reports" section on the framapad here: https://annuel.framapad.org/p/koha_34478_remaining Additional entries can be added there, and should be crossed out when completed Patches should be attached here This bug can be closed when that section of the pad is empty -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 34

[Bug 36102] Protect login forms from CSRF attacks
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36102 Bug 36102 depends on bug 34478, which changed state. Bug 34478 Summary: Full CSRF protection https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 36148] Move CSRF check code outside of CGI->new
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36148 Bug 36148 depends on bug 34478, which changed state. Bug 34478 Summary: Full CSRF protection https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34478 What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 35992] New: opac-shareshelf: Accepting invitation should not be triggered directly
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35992 Bug ID: 35992 Summary: opac-shareshelf: Accepting invitation should not be triggered directly Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Lists Assignee: koha-bugs(a)lists.koha-community.org Reporter: m.de.rooy(a)rijksmuseum.nl QA Contact: testopia(a)bugs.koha-community.org CC: m.de.rooy(a)rijksmuseum.nl See bug 35445. Microsoft Safe Links should not try to accept the list invite. Resolve by adding a separate accept button on the form. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 8

[Bug 38199] New: Printing transfer slips from circ/returns.pl doesn't set focus properly ( 24.05.x and below )
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38199 Bug ID: 38199 Summary: Printing transfer slips from circ/returns.pl doesn't set focus properly ( 24.05.x and below ) Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: lucas(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com This problem is fixed in main by Bug 35402. ( commit 5fe1ad8ac66072ef7e06d21d0ccc48d388ecaf79 ) - <button type="button" data-dismiss="modal" class="btn btn-default" accesskey="y"><i class="fa fa-check"></i> OK (Y)</button> - <button type="button" data-dismiss="modal" class="btn btn-default openWin" data-url="transfer-slip.pl?transferitem=[% itemnumber | uri %]&branchcode=[% transfer | uri %]&op=slip" accesskey="p"><i class="fa fa-print"></i> Print slip (P)</button> + <button type="button" data-bs-dismiss="modal" class="btn btn-default" accesskey="y"><i class="fa fa-check"></i> OK (Y)</button> + <button type="button" data-bs-dismiss="modal" class="btn btn-default print openWin" data-url="transfer-slip.pl?transferitem=[% itemnumber | uri %]&branchcode=[% transfer | uri %]&op=slip" accesskey="p"><i class="fa fa-print"></i> Print slip (P)</button> We need the same fix in 24.05.x and below. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 14