October 2026 - Koha-bugs - lists.koha-community.org

[Bug 13840] Don't show library filter on full serial issue history in OPAC for single branch libraries
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '26

08 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13840 --- Comment #2 from Laura Escamilla <Laura.escamilla(a)bywatersolutions.com> --- Created attachment 207446 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=207446&action=e… Bug 13840: Hide library filter for single-branch serial history Description: Hide the Library filter on the OPAC full serial issue history page when Koha is configured with only one library, using the existing singleBranchMode template variable. Additional updates were made to the filtering JavaScript to ensure the Subscription filter continues to function independently of the Library filter. Previously, the Subscription dropdown depended on the Library filter being present and could remain disabled or unpopulated. The Library filter was also updated to display the configured libraries consistently, rather than relying solely on libraries found in the serial issue history. Test plan: 1. Navigate to a bibliographic record with a serial subscription in the OPAC. 2. Select Subscriptions → More details → Full history. 3. With only one library configured, verify the Library filter is hidden. 4. Verify the Subscription dropdown is populated and can filter serial issues without the Library filter being present. 5. Add a second library and reload the page. 6. Verify the Library filter is displayed and contains the configured libraries. 7. Verify the Subscription dropdown remains populated and functional when the Library filter is present. 8. Select a library and verify the displayed serial issues are filtered appropriately. 9. Verify the Subscription dropdown updates appropriately when changing the selected library. 10. Select a subscription and verify only matching serial issues are displayed. 11. Click Clear and verify the filters reset correctly. 12. Switch between available years and verify the filters continue to work as expected. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 13840] Don't show library filter on full serial issue history in OPAC for single branch libraries
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '26

08 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13840 Laura Escamilla <Laura.escamilla(a)bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|oleonard(a)myacpl.org |Laura.escamilla@bywatersolu | |tions.com Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 43752] New: [OMNIBUS] Simplify system preferences
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '26

08 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43752 Bug ID: 43752 Summary: [OMNIBUS] Simplify system preferences Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: System Administration Assignee: koha-bugs(a)lists.koha-community.org Reporter: philip.orr(a)lmscloud.de QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Target Milestone: --- Omnibus bug for gathering suggestions for making system preferences simpler for libraries with simpler use cases. Several different approaches have been discussed and will be put in the comments below. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 3

[Bug 43264] New: Update some circulation pages to use grid layout for forms
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '26

08 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43264 Bug ID: 43264 Summary: Update some circulation pages to use grid layout for forms Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Templates Assignee: oleonard(a)myacpl.org Reporter: oleonard(a)myacpl.org QA Contact: testopia(a)bugs.koha-community.org Depends on: 39780 Target Milestone: --- - circ/request-article.tt - circ/set-library.tt Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39780 [Bug 39780] Update library groups form to use grid layout -- You are receiving this mail because: You are watching all bug changes.

1 5

[Bug 43470] REST Basic Auth allows silent 2FA secret takeover
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '26

08 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43470 --- Comment #23 from Pedro Amorim (ammopt) <pedro.amorim(a)openfifth.co.uk> --- Hi all, the guard is not robust enough, the registration endpoint can still be reached using Basic Auth if the URL has a trailing slash: 1) Turn on 'TwoFactorAuthentication' and 'RESTBasicAuth' 2) In ktd --shell, mark koha as 2FA-enrolled: echo "UPDATE borrowers SET auth_method='two-factor' WHERE userid='koha'" | koha-mysql kohadev 3) Run: curl -u koha:koha -X POST http://localhost:8081/api/v1/auth/two-factor/registration 4) Notice {"error":"Cannot request this route."}, the patch blocks this 5) Run it again with a trailing slash: curl -u koha:koha -X POST http://localhost:8081/api/v1/auth/two-factor/registration/ 6) Notice you get a new 'secret32' and 'qr_code' back, the guard is bypassed 7) Undo, otherwise koha's staff login will ask for a 2FA code: echo "UPDATE borrowers SET auth_method='password' WHERE userid='koha'" | koha-mysql kohadev 'registration/verification/' should also be double-checked, as it's guarded by the same check. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 43470] REST Basic Auth allows silent 2FA secret takeover
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '26

08 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43470 Pedro Amorim (ammopt) <pedro.amorim(a)openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|26.05.04,25.11.09,25.05.15, |26.11.00,26.05.04,25.11.09, released in|24.11.20 |25.05.15,24.11.20 Keywords|RM_priority | Resolution|--- |FIXED CC| |pedro.amorim(a)openfifth.co.u | |k Status|Pushed to stable |RESOLVED --- Comment #22 from Pedro Amorim (ammopt) <pedro.amorim(a)openfifth.co.uk> --- Thanks everyone! Pushed to main for 26.11! -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 43426] admin/item_circulation_alerts.pl cud-toggle performs no authentication check at all (7.5 HIGH)
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '26

08 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43426 Pedro Amorim (ammopt) <pedro.amorim(a)openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |pedro.amorim(a)openfifth.co.u | |k Resolution|--- |FIXED Version(s)|26.05.04,25.11.09,25.05.15, |26.11.00,26.05.04,25.11.09, released in|24.11.20 |25.05.15,24.11.20 Status|Pushed to stable |RESOLVED Keywords|RM_priority | --- Comment #25 from Pedro Amorim (ammopt) <pedro.amorim(a)openfifth.co.uk> --- Thanks everyone! Pushed to main for 26.11! -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 43424] REST Basic Auth bypasses account lockout (8.1 HIGH)
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '26

08 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43424 Pedro Amorim (ammopt) <pedro.amorim(a)openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Keywords|RM_priority | Version(s)|26.05.04,25.11.09,25.05.15, |26.11.00,26.05.04,25.11.09, released in|24.11.20 |25.05.15,24.11.20 Status|Pushed to stable |RESOLVED CC| |pedro.amorim(a)openfifth.co.u | |k --- Comment #21 from Pedro Amorim (ammopt) <pedro.amorim(a)openfifth.co.uk> --- Thanks everyone! Pushed to main for 26.11! -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 43326] Stored XSS in patron account note (accountlines.note)
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '26

08 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43326 Pedro Amorim (ammopt) <pedro.amorim(a)openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|RM_priority | Status|Pushed to stable |RESOLVED Version(s)|26.05.04,25.11.09,25.05.15, |26.11.00,26.05.04,25.11.09, released in|24.11.20 |25.05.15,24.11.20 CC| |pedro.amorim(a)openfifth.co.u | |k Resolution|--- |FIXED --- Comment #15 from Pedro Amorim (ammopt) <pedro.amorim(a)openfifth.co.uk> --- Thanks everyone! Pushed to main for 26.11! -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42674] OS command injection via `jobid` in Task Scheduler (`tools/scheduler.pl`)
by bugzilla-daemon＠bugs.koha-community.org 08 Oct '26

08 Oct '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42674 Pedro Amorim (ammopt) <pedro.amorim(a)openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|RM_priority | Resolution|--- |FIXED CC| |pedro.amorim(a)openfifth.co.u | |k Status|Pushed to stable |RESOLVED Version(s)|26.05.04,25.05.15,24.11.20, |26.11.00,26.05.04,25.05.15, released in|25.11.09 |24.11.20,25.11.09 --- Comment #17 from Pedro Amorim (ammopt) <pedro.amorim(a)openfifth.co.uk> --- Thanks everyone! Pushed to main for 26.11! -- You are receiving this mail because: You are watching all bug changes.

1 0