July 2025 - Koha-bugs - lists.koha-community.org

[Bug 28957] Many plugins require the full plugins permission set to run
by bugzilla-daemon＠bugs.koha-community.org 21 Jul '25

21 Jul '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28957 --- Comment #5 from David Cook <dcook(a)prosentient.com.au> --- (In reply to Fridolin Somers from comment #3) > Indeed the permissions are on the plugin method : > https://git.koha-community.org/Koha-community/Koha/src/commit/ > ac02c1d2adc883cc6ff6b749c271cb165d337436/plugins/run.pl#L40 > > But currently only exists tool and report > and plugins create there own methods. These days, there are permissions for these methods: "report", "tool", "admin", or "configure" > Should we change for only one subpermission "run plugin" ? > And plugins have to implement permissions. That could be difficult to apply retroactively, but might not be a bad idea. I've been thinking a bit about "permission policies" which could be applied at different levels (like the borrower as user/subject or the plugin as object/resource). It could be an opportunity to experiment with the idea. The idea being Koha core would have the code like "Koha::Authz::authorize($user,$action,$resource). I haven't fully thought out the design, but the idea would be that there's a permission policy attached to that Koha plugin $resource and it says whether a particular user or categorycode (or whatever) is allowed to do $action against it. That "run plugin" could be the minimum level of permission that a user needs in order to run "run.pl" at all, and then permission policies could kick in from there. For backwards compatibility, we'd probably need to let "report", "tool", "admin" have "run_plugin". Not sure about "configure". -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 28957] Many plugins require the full plugins permission set to run
by bugzilla-daemon＠bugs.koha-community.org 21 Jul '25

21 Jul '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28957 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook(a)prosentient.com.au --- Comment #4 from David Cook <dcook(a)prosentient.com.au> --- So I was just about to report this as a security vulnerability... My perspective is if you have top-level "plugins" permissions, you can run any method in a plugin, and that's bad. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 37021] New: REST API: Holds endpoint handles item_id as string in GET call
by bugzilla-daemon＠bugs.koha-community.org 19 Jul '25

19 Jul '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37021 Bug ID: 37021 Summary: REST API: Holds endpoint handles item_id as string in GET call Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: REST API Assignee: koha-bugs(a)lists.koha-community.org Reporter: emmi.takkinen(a)koha-suomi.fi CC: tomascohen(a)gmail.com When one makes a GET call to holds endpoint and hold has item attached to it, item_id is handled as string not integer as it should. To reproduce: 1. Make sure you have hold waiting in your database. 1. Call endpoint api/v1/holds/?q=[{"me.status":"W"}]. 2. Note that holds item_id is displayed as item_id: "12345". -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 17

[Bug 37809] New: Add missing embeds to checkouts endpoints
by bugzilla-daemon＠bugs.koha-community.org 19 Jul '25

19 Jul '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37809 Bug ID: 37809 Summary: Add missing embeds to checkouts endpoints Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: REST API Assignee: koha-bugs(a)lists.koha-community.org Reporter: tomascohen(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org CC: tomascohen(a)gmail.com -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 26

[Bug 39970] New: REST API - Creating a patron without mandatory attribute types does not error (it should)
by bugzilla-daemon＠bugs.koha-community.org 19 Jul '25

19 Jul '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39970 Bug ID: 39970 Summary: REST API - Creating a patron without mandatory attribute types does not error (it should) Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: REST API Assignee: pedro.amorim(a)openfifth.co.uk Reporter: pedro.amorim(a)openfifth.co.uk QA Contact: testopia(a)bugs.koha-community.org CC: tomascohen(a)gmail.com Depends on: 39334 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39334 [Bug 39334] Preserve order when saving patron attributes -- You are receiving this mail because: You are watching all bug changes.

1 20

[Bug 37032] New: REST API: Unable to call item info via holds endpoint
by bugzilla-daemon＠bugs.koha-community.org 19 Jul '25

19 Jul '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37032 Bug ID: 37032 Summary: REST API: Unable to call item info via holds endpoint Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: REST API Assignee: koha-bugs(a)lists.koha-community.org Reporter: emmi.takkinen(a)koha-suomi.fi CC: tomascohen(a)gmail.com I'm trying to fetch items barcode via holds endpoint with no luck. If I've understood correctly, this should be possible by adding item as embed in /api/v1/swagger/paths/holds.yaml and then adding it to enum option in kohaTable function. However this only leads to following error: >Something went wrong when loading the table. >400: Bad Request. >Not in enum list: cancellation_requested, biblio, pickup_library, item. Documentation for endpoint shows that endpoint should produce item object and Koha::Hold does have relation to item. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 20

[Bug 33018] New: debian package tidy-up
by bugzilla-daemon＠bugs.koha-community.org 19 Jul '25

19 Jul '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33018 Bug ID: 33018 Summary: debian package tidy-up Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Packaging Assignee: koha-bugs(a)lists.koha-community.org Reporter: mtj(a)kohaaloha.com QA Contact: testopia(a)bugs.koha-community.org CC: mtj(a)kohaaloha.com this bug aims to track a tidy-up of debian package files -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 43

[Bug 40454] New: Funds table needs link in Total Spent column to show items
by bugzilla-daemon＠bugs.koha-community.org 18 Jul '25

18 Jul '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40454 Bug ID: 40454 Summary: Funds table needs link in Total Spent column to show items Change sponsored?: --- Product: Koha Version: 24.11 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Acquisitions Assignee: koha-bugs(a)lists.koha-community.org Reporter: esther.melander(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org To Replicate: 1. Be sure there is an acquisitions budget and funds. Create some baskets with orders. 2. Go to the Acquisitions home page and scroll to the budget. Click on the spent amount for one of the funds. See that the link takes the user to a list of the items ordered. 3. Now click on Funds from the left menu panel. See that there is no links for the Total Spent column. It would be nice if the Total Spent column on the funds page went to the same URL as from the Acquisitions home page, budget table column for Spent. /cgi-bin/koha/acqui/spent.pl?fund=XX&fund_code=YY -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 14414] Add field for processing fee for invoices
by bugzilla-daemon＠bugs.koha-community.org 18 Jul '25

18 Jul '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14414 --- Comment #9 from Martin Renvoize (ashimema) <martin.renvoize(a)openfifth.co.uk> --- We now have a 'post processing' EDI script in place for our site that extracts these and adds them as invoice adjustments. I think in the future it would be best to focus on Acq 2.0 and more formally working this capture into the core EDI process, but right now the adjustments is the best we have without the full rethink on architecture that's underway in other bugs. I'm happy to share the post-processing script for those that may be interested, with customer details redacted. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38373] New: Mandatory patron relationship has to be selected twice
by bugzilla-daemon＠bugs.koha-community.org 18 Jul '25

18 Jul '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38373 Bug ID: 38373 Summary: Mandatory patron relationship has to be selected twice Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Patrons Assignee: koha-bugs(a)lists.koha-community.org Reporter: johanna.raisa(a)koha-suomi.fi QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com When relationship is a mandatory the field has to be selected twice, for non-patron guarantor and patron guarantor. There should be a some kind of check which input fields are filled and the relationship requirement is based on that. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 21