August 2025 - Koha-bugs - lists.koha-community.org

[Bug 40714] New: cookieConsent: current approach arguable on public computers or shared devices
by bugzilla-daemon＠bugs.koha-community.org 27 Aug '25

27 Aug '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40714 Bug ID: 40714 Summary: cookieConsent: current approach arguable on public computers or shared devices Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: m.de.rooy(a)rijksmuseum.nl QA Contact: testopia(a)bugs.koha-community.org Since we just save a simple key in localStorage, this may still be active on public computers for the next user of that computer? Unless they have separate guest accounts, or cookies and localStorage are cleared when the browser exits. Should we make a difference between browsing anonymous or logging in to Koha within this context of public computers? If so, we might need to save data in the db instead of locally? Looks like this report is less clear than the two others (40712 and 40713). -- You are receiving this mail because: You are watching all bug changes.

1 1

[Bug 40712] New: cookieConsent: Accepting essential cookies is unneeded/misleading
by bugzilla-daemon＠bugs.koha-community.org 27 Aug '25

27 Aug '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40712 Bug ID: 40712 Summary: cookieConsent: Accepting essential cookies is unneeded/misleading Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: m.de.rooy(a)rijksmuseum.nl QA Contact: testopia(a)bugs.koha-community.org It feels a bit strange to Accept essential cookies. If you dont accept, they work anyway. And if you can accept, you would expect a reject either. But you cant reject them: they are essential and the code just uses them. If there are no additional non-essential cookies, it feels like the bar just needs a OK button to dismiss a message that there are only essential cookies. (This dismissal is not an accept.) "Under GDPR, essential (or strictly necessary) cookies are exempt from requiring user consent because they are fundamental for basic website functionality." -- You are receiving this mail because: You are watching all bug changes.

1 1

[Bug 40572] New: Deleting serial issues should be logged
by bugzilla-daemon＠bugs.koha-community.org 27 Aug '25

27 Aug '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40572 Bug ID: 40572 Summary: Deleting serial issues should be logged Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Serials Assignee: koha-bugs(a)lists.koha-community.org Reporter: lisette(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org Deletion of serial issues is not logged in the action logs. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 1

[Bug 27378] New: Enable compliance with EU Cookie Legislation via cookie consent
by bugzilla-daemon＠bugs.koha-community.org 27 Aug '25

27 Aug '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27378 Bug ID: 27378 Summary: Enable compliance with EU Cookie Legislation via cookie consent Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: andrew.isherwood(a)ptfs-europe.com QA Contact: testopia(a)bugs.koha-community.org This bug proposes to add the ability for a site to comply with EU Cookie Legislation if required, through the use of cookie consent. Cookie use that requires consent involves the use of "non-essential" cookies. For the implementation of this bug, we are considering all cookies set by Koha itself to be "essential", and therefore not requiring consent. "Non-essential" cookies will potentially be anything else, for example, Google Analytics tracking. This bug will provide the following: - Allow an admin to define code that requires consent to run (e.g. code that results in a non-essential cookie being set). Along with a name & description for that code, and the ability to specify whether that code requires consent before running, both in the OPAC and staff interface. - Allow a user to see exactly which cookies (essential & non-essential) may be set and which non-essential cookies they can consent to if they wish. The detail of the cookies in use is definable by a site admin. - Allow a user to consent to any non-essential cookies. - Allow a user to see which non-essential cookies they have consented to and, subsequently, remove consent if they wish. - Prevent the running of any code that causes a non-essential cookie to be set unless the user has explicitly consented to it. -- You are receiving this mail because: You are watching all bug changes.

1 249

[Bug 40579] CSV formula injection protection
by bugzilla-daemon＠bugs.koha-community.org 27 Aug '25

27 Aug '25

1 0

[Bug 40538] XSS in hold suspend modal in staff interface
by bugzilla-daemon＠bugs.koha-community.org 27 Aug '25

27 Aug '25

1 0

[Bug 39906] Add bot challenge (in Apache layer)
by bugzilla-daemon＠bugs.koha-community.org 27 Aug '25

27 Aug '25

1 0

[Bug 40707] New: Search engine mappings and indexes should be sent in request body
by bugzilla-daemon＠bugs.koha-community.org 27 Aug '25

27 Aug '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40707 Bug ID: 40707 Summary: Search engine mappings and indexes should be sent in request body Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Staff interface Assignee: koha-bugs(a)lists.koha-community.org Reporter: tomascohen(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com When saving mappings and indexes a POST is sent with 5000+ query parameters. This can cause issues in reverse proxies or modsecurity default settings. We should be sending them in the request body anyway. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 1

[Bug 40705] New: Password expiry date blocks SSO authentication
by bugzilla-daemon＠bugs.koha-community.org 27 Aug '25

27 Aug '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40705 Bug ID: 40705 Summary: Password expiry date blocks SSO authentication Change sponsored?: --- Product: Koha Version: 24.05 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Authentication Assignee: koha-bugs(a)lists.koha-community.org Reporter: koha(a)collecto.ca QA Contact: testopia(a)bugs.koha-community.org CC: dpavlin(a)rot13.org Iam only able to test on our Koha, which is not a "vanilla" environment, so I don't know if it's only us o not. We've added an identity provider to be able to login with Microsoft on the OPAC. And to "force" people to use that login method instead of the manual one, we added an expiry date on everybody's password in Koha. The idea was that, with their password expired, the patrons would need to use the Microsoft auth. But the issue is, when the password is expired in Koha, the Microsoft authentication doesn't work. We are redirected to the Microsoft login page, but then when we are returned in Koha, we have the expired password alert. We are able to connect to the OPAC using Microsoft only after deleting the password expiry date or renewing the password from the staff interface or the OPAC. So it seems like the password expiry date applies to the entire ability to connect to the OPAC and not just on the password provided by Koha... To test : 1. Add an identity provider with OIDC protocol. 2. Make sure both the Microsoft authentication and the manual one work as it should. 3. Add a password expiry date to the current date or before. 4. Try either one of the authentication method, you will receive the alert about the password being expired. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 2

[Bug 40531] New: Make AuthID a hyperlinked element in reports
by bugzilla-daemon＠bugs.koha-community.org 26 Aug '25

26 Aug '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40531 Bug ID: 40531 Summary: Make AuthID a hyperlinked element in reports Change sponsored?: --- Product: Koha Version: 24.11 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Reports Assignee: koha-bugs(a)lists.koha-community.org Reporter: maxeinergl(a)gcc.edu QA Contact: testopia(a)bugs.koha-community.org CC: lisette(a)bywatersolutions.com Add the authority record ID number (authid) to the list of unique record identifers that are automatically hyperlinked in Koha Reports. As with itemnumber and biblionumber, "view" and "edit" record are ideal functions for the hyperlink. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 2