October 2026 - Koha-bugs - lists.koha-community.org

[Bug 43001] New: Non priority hold label doesn't always appear on reserve/request.pl
by bugzilla-daemon＠bugs.koha-community.org 16 Oct '26

16 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43001 Bug ID: 43001 Summary: Non priority hold label doesn't always appear on reserve/request.pl Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: lucas(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle(a)bywatersolutions.com Target Milestone: --- To recreate: 1. Place a item level hold, making sure to mark it as "Non priority hold" 2. After placing the hold, on reserve/request.pl look at the "Details" column 3. Notice the hold is missing "Non priority hold" text in the details column -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 16

[Bug 43837] New: [INC-2026-0183] CVE Coordination in Koha
by bugzilla-daemon＠bugs.koha-community.org 16 Oct '26

16 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43837 Bug ID: 43837 Summary: [INC-2026-0183] CVE Coordination in Koha Initiative type: --- Sponsorship --- status: Product: Koha Version: 26.05 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: bugs.koha-community.org Assignee: koha-bugs(a)lists.koha-community.org Reporter: cve-coordination(a)incibe.es QA Contact: testopia(a)bugs.koha-community.org Target Milestone: --- Created attachment 208303 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=208303&action=e… draft vulnerability 1 Dear Koha team, We are writing to you from INCIBE, Spain's National Cybersecurity Institute, regarding 3 vulnerabilities reported by an external researcher in one of your products. We participate in the CVE Program as CNA Root (https://www.cve.org/ProgramOrganization/Structure) which allows us to assign and publish CVE codes. Please note that this report is not about an incident, i.e. no one is exploiting the vulnerability. At INCIBE, we are responsible for managing the documentation and publication of the CVE identifier, in coordination with the affected parties. As established in our disclosure policy, we have set a default period of 60 days for you to take some kind of action to resolve these vulnerabilities, so we will begin working on its publication once this period has ended. If you wish to include a solution or additional information for the problems reported in this email, please respond before the expiry date. Please find attached the drafts of the vulnerabilities. Thank you very much and best regards, -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 2

[Bug 43604] New: commit_file.pl --revert dies: safe_to_delete calls can_edit_items_from on undef
by bugzilla-daemon＠bugs.koha-community.org 16 Oct '26

16 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43604 Bug ID: 43604 Summary: commit_file.pl --revert dies: safe_to_delete calls can_edit_items_from on undef Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Tools Assignee: koha-bugs(a)lists.koha-community.org Reporter: martin.renvoize(a)openfifth.co.uk QA Contact: testopia(a)bugs.koha-community.org Target Milestone: --- This fixes a regression introduced by bug 33070, where Koha::Item->safe_to_delete assumed C4::Context->userenv->{number} always corresponds to a real Koha::Patron. misc/commit_file.pl sets a dummy CLI userenv with borrowernumber 0: C4::Context->set_userenv( 0, 'batch', 0, 'batch', 'batch', 'batch', 'batch' ); Running --revert on a batch calls C4::ImportBatch::BatchRevertItems, which calls Koha::Item->safe_delete on every item created by the batch. safe_delete calls safe_to_delete, which runs: !Koha::Patrons->find( C4::Context->userenv->{number} )->can_edit_items_from( $self->homebranch ) Since there is no patron with borrowernumber 0, Koha::Patrons->find returns undef, and calling ->can_edit_items_from on undef is a fatal error that aborts the whole script. Other call sites touched by bug 33070 already guard against a missing patron (e.g. Koha::UI::Table::Builder::Items->build_table: nomod => $patron ? !$patron->can_edit_items_from(...) : 0), but Koha::Item->safe_to_delete never got the same guard. Test plan: 1. Stage and commit a batch of records so items get created (e.g. via the Manage staged MARC records tool, or misc/commit_file.pl --batch-number NNN). 2. Run: misc/commit_file.pl --batch-number NNN --revert 3. Without this patch, the script dies with: Can't call method "can_edit_items_from" on an undefined value at Koha/Item.pm line 374. 4. Apply the patch. 5. Run: prove t/db_dependent/Koha/Item.t -- all tests pass, including the new regression test. 6. Repeat step 2 -- the batch reverts successfully. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 15

[Bug 42842] New: Remove materialized patron data from tmp_holdsqueue
by bugzilla-daemon＠bugs.koha-community.org 16 Oct '26

16 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42842 Bug ID: 42842 Summary: Remove materialized patron data from tmp_holdsqueue Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: tomascohen(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Depends on: 42503 Target Milestone: --- Since bug 42503 converted the holds queue page to be API-driven, the materialized patron fields in tmp_holdsqueue (surname, firstname, phone, cardnumber) are no longer used. The page now embeds patron data via the borrowernumber FK through the REST API. These columns should be removed because: 1. They are dead code â nothing reads them after bug 42503 2. They leave patron PII (name, phone, card number) in an unaudited table that is not subject to patron data cleanup/anonymization routines 3. Privacy concern: tmp_holdsqueue is rebuilt periodically but retains patron information between rebuilds, and this data is not covered by GDPR/privacy cleanup tools The fix should: - Remove surname, firstname, phone, cardnumber columns from tmp_holdsqueue - Stop populating them in C4::HoldsQueue::CreatePicklistFromItemMap - Update Koha::Schema::Result::TmpHoldsqueue - Remove the undef mappings in Koha::Hold::HoldsQueueItem::to_api_mapping Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42503 [Bug 42503] Render the holds queue using the REST API -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 33

[Bug 43388] New: Create Koha::Old::Authority objects
by bugzilla-daemon＠bugs.koha-community.org 16 Oct '26

16 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43388 Bug ID: 43388 Summary: Create Koha::Old::Authority objects Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: m.de.rooy(a)rijksmuseum.nl QA Contact: testopia(a)bugs.koha-community.org Target Milestone: --- We have the table, but we still need the Koha objects. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 10

[Bug 42778] New: Editing SIP configuration through staff interface can silently change default behavior on upgraded systems
by bugzilla-daemon＠bugs.koha-community.org 16 Oct '26

16 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42778 Bug ID: 42778 Summary: Editing SIP configuration through staff interface can silently change default behavior on upgraded systems Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: SIP2 Assignee: koha-bugs(a)lists.koha-community.org Reporter: emily.lamancusa(a)montgomerycountymd.gov QA Contact: testopia(a)bugs.koha-community.org Depends on: 37839 I noticed and confirmed this bug for the setting "Holds get captured", but I'm not sure if it affects other settings as well. Before bug 37893, if a SIP account did not have a value defined in koha-conf for holds_get_captured, the default behavior was to capture holds. However, the staff interface editor for SIP accounts only has the options "Yes" and "No", and when the page loads, it selects the "No" radio button if the value is undefined. As a result, if a staff administrator edits any other field of the SIP account and saves changes, that undefined value (which previously did capture holds) gets silently set to "no", don't capture holds. I can confirm that the following settings do *not* have this bug, as the default behavior is "No" if the setting is undefined: allow additional materials checkout allow empty passwords format due date holds block checkin block previous checkout I'm not sure about the following settings - they should be tested: checked in ok CT always send CV always send 00 on success CV triggers alert disallow overpayment error detect overdues block checkout send patron home library in AF show checkin message show outstanding amount It would probably be safest to explicitly set the default values for these yes/no fields on upgrade (including the ones whose default is already "no" for future-proofing), as well as add a database update to main to set any undefined values to the correct defaults. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37839 [Bug 37839] /api endpoint stops working on strict firewall -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 8

[Bug 39407] New: Having no active currency defined breaks SIP silently
by bugzilla-daemon＠bugs.koha-community.org 16 Oct '26

16 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39407 Bug ID: 39407 Summary: Having no active currency defined breaks SIP silently Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: SIP2 Assignee: koha-bugs(a)lists.koha-community.org Reporter: kyle(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org In the staff interface, in most areas of Koha that require an active currency to be defined, a large info box appears to let the user know there is no active currency defined. Our SIP code presumes an active currency and if one is not defined, any SIP messages utilizing C4::SIP::ILS::Patron will crash with no errors such that a response is never transmitted for the request. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 14

[Bug 39139] New: SIP2 patron lookups can fail if no active currency is set
by bugzilla-daemon＠bugs.koha-community.org 16 Oct '26

16 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39139 Bug ID: 39139 Summary: SIP2 patron lookups can fail if no active currency is set Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: SIP2 Assignee: koha-bugs(a)lists.koha-community.org Reporter: gmcharlt(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org If no active currency is set, SIIP2 patron information lookups can fail to return a response. This was observed for message 23 responses, but probably also affects message 63 responses. The problem is line 128 of C4/SIP/ILS/Patron.pm: my $currency = substr Koha::Acquisition::Currencies->get_active->currency, 0, 3; If no currency is active, an exception is thrown and the SIP protocol loop terminates. This likely affects all releases that include the patches for bug 23426 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 4

[Bug 40032] New: Make SIP2 log missing active currency
by bugzilla-daemon＠bugs.koha-community.org 16 Oct '26

16 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40032 Bug ID: 40032 Summary: Make SIP2 log missing active currency Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: SIP2 Assignee: koha-bugs(a)lists.koha-community.org Reporter: magnus(a)libriotech.no QA Contact: testopia(a)bugs.koha-community.org We just had a situation where "Patron Status Requests" were failing, because no currency was set to active. There was a warning about this in "About Koha > System information", but it would be nice if there was a warning in the SIP2 log too. To reproduce in KTD: Make sure not currency is active, then: $ telnet localhost 6001 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. 9300CNterm1|COterm1|CPCPL 941 2300120250530 090947AOCPL|AAterm1|AC|ADterm1 Connection closed by foreign host. In /var/log/koha/kohadev/sip-output.log: [2025/05/30 08:34:28] [2336] [INFO] term1(a)127.0.0.1: INPUT MSG: '2300120250530 090947AOCPL|AAterm1|AC***|ADterm1' C4::SIP::Sip::siplog /kohadevbox/koha/C4/SIP/Sip.pm (319) [2025/05/30 08:34:28] [2336] [DEBUG] term1(a)127.0.0.1: Sip::MsgType::new('C4::SIP::Sip::MsgType', '2300120250...', '23'): seq.no '0', protocol 2 C4::SIP::Sip::siplog /kohadevbox/koha/C4/SIP/Sip.pm (319) [2025/05/30 08:34:28] [2336] [DEBUG] term1(a)127.0.0.1: Sip::MsgType::_initialize('Patron Status Request', '00120250530 090947AOCPL|AAterm1|AC***|ADterm1', 'A3A18', '21', ...) C4::SIP::Sip::siplog /kohadevbox/koha/C4/SIP/Sip.pm (319) [2025/05/30 08:34:28] [2336] [DEBUG] term1(a)127.0.0.1: Debarred = undef : C4::SIP::Sip::siplog /kohadevbox/koha/C4/SIP/Sip.pm (319) [2025/05/30 08:34:28] [2336] [INFO] term1(a)127.0.0.1: raw_transport: shutting down C4::SIP::Sip::siplog /kohadevbox/koha/C4/SIP/Sip.pm (319) Suggested solution: In C4::SIP::ILS::Patron::new() we do this: # Get currency 3 chars max my $currency = substr Koha::Acquisition::Currencies->get_active->currency, 0, 3; We could add a check for defined $currency and a log message if it is not defined. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 6

[Bug 41178] New: SIP2 module does not notify that linked accounts are deleted when deleting an institution
by bugzilla-daemon＠bugs.koha-community.org 16 Oct '26

16 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41178 Bug ID: 41178 Summary: SIP2 module does not notify that linked accounts are deleted when deleting an institution Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: SIP2 Assignee: koha-bugs(a)lists.koha-community.org Reporter: pedro.amorim(a)openfifth.co.uk QA Contact: testopia(a)bugs.koha-community.org -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 34