June 2025 - Koha-bugs - lists.koha-community.org

[Bug 29956] Cookie can contain plain text password
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29956 Wainui Witika-Park <wainuiwitikapark(a)catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Pushed to oldoldoldstable |RESOLVED -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 28926] New: Update cpanfile for Mojolicious::Plugin::OpenAPI v2.16
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28926 Bug ID: 28926 Summary: Update cpanfile for Mojolicious::Plugin::OpenAPI v2.16 Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Packaging Assignee: koha-bugs(a)lists.koha-community.org Reporter: mtj(a)kohaaloha.com QA Contact: testopia(a)bugs.koha-community.org CC: mtj(a)kohaaloha.com this bug updates cpanfile for Mojolicious::Plugin::OpenAPI v2.16 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 34

[Bug 29957] Cookies not removed after logout
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 Bug 29957 depends on bug 29914, which changed state. Bug 29914 Summary: check_cookie_auth not strict enough https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29914 What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldoldoldstable |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29915] Anonymous session generates 1 new session ID per hit
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29915 Bug 29915 depends on bug 29914, which changed state. Bug 29914 Summary: check_cookie_auth not strict enough https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29914 What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldoldoldstable |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29914] New: check_cookie_auth not strict enough
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29914 Bug ID: 29914 Summary: check_cookie_auth not strict enough Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: ASSIGNED Severity: critical Priority: P5 - low Component: Authentication Assignee: jonathan.druart+koha(a)gmail.com Reporter: jonathan.druart+koha(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org CC: dpavlin(a)rot13.org This has been found on bug 28786 comment 91. check_cookie_auth is assuming that the user is authenticated if a cookie exists and that the login/username exists in the DB. This is very bad! I have no idea what are the possible breaches it opens, but there are certainly some. -- You are receiving this mail because: You are watching all bug changes.

1 11

[Bug 29903] Message deletion possible from different branch
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29903 Wainui Witika-Park <wainuiwitikapark(a)catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldoldoldstable |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29544] A patron can set everybody's checkout notes
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29544 Wainui Witika-Park <wainuiwitikapark(a)catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldoldoldstable |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29542] User with 'catalogue' permission can view everybody's (private) virtualshelves
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29542 Wainui Witika-Park <wainuiwitikapark(a)catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Pushed to oldoldoldstable |RESOLVED -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29541] Patron images can be accessed with just 'catalogue' permission
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29541 Wainui Witika-Park <wainuiwitikapark(a)catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldoldoldstable |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 30207] New: Librarians with only "place_holds" permission can no longer update hold pickup locations
by bugzilla-daemon＠bugs.koha-community.org 23 Jun '25

23 Jun '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30207 Bug ID: 30207 Summary: Librarians with only "place_holds" permission can no longer update hold pickup locations Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Hold requests Assignee: koha-bugs(a)lists.koha-community.org Reporter: kyle(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Bug 29540 increased the flags required to for modreserve.pl, but in doing so created a situation where a library can select a different pickup location for a hold, but upon clicking the "Update hold(s)" button, will be logged out due to having insufficient permissions for modreserve.pl. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 36