February 2026 - Koha-bugs - lists.koha-community.org

[Bug 40602] New: Broken HTML showing in Alert 'subscriptions' tab
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40602 Bug ID: 40602 Summary: Broken HTML showing in Alert 'subscriptions' tab Change sponsored?: --- Product: Koha Version: 24.11 Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: katrin.fischer(a)bsz-bw.de QA Contact: testopia(a)bugs.koha-community.org In the "Alert subscriptions" tab in the OPAC there is broken HTML showing on the page, maybe from a merge conflict, because it doesn't actually make sense, to display the name in that spot. To test: * Add a serial subscription and set a notification template * Go to the OPAC and subscribe to the email notification for this subscription (you must be logged in to see the button on the subscriptions tab) * Go to the patron account > tab alert subscriptions * Verify in the last column something like this shows: Frau Karin Mustermann"> X Unsubscribe from email alerts The "Frau Karin Mustermann">" should not be there. -- You are receiving this mail because: You are watching all bug changes.

1 33

[Bug 41810] New: Missing patron.title from Bug 40602
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41810 Bug ID: 41810 Summary: Missing patron.title from Bug 40602 Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: lucas(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org >From Bug 40602: The line : - <span class="patron-title">[% patron.title | html %]</span> Becomes : + <span class="patron-title"></span> So there is no content. I bet this is not what we want. Since this is backported to 25.11.00,25.05.04 I think we should do the additional work here. -- You are receiving this mail because: You are watching all bug changes.

1 5

[Bug 10190] Overdue notice triggers based on item type
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10190 --- Comment #315 from Martin Renvoize (ashimema) <martin.renvoize(a)openfifth.co.uk> --- Created attachment 193979 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193979&action=e… Bug 10190: Patron categories fetch shouldn't require full manage permission Patch from commit 2727bf7 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 41943] New: Purchase suggestion URL truncated when not logged in
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41943 Bug ID: 41943 Summary: Purchase suggestion URL truncated when not logged in Initiative type: --- Sponsorship --- status: Product: Koha Version: 25.05 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: david.roberts(a)openfifth.co.uk QA Contact: testopia(a)bugs.koha-community.org If you use this URL to log a purchase suggestion when not logged in: /cgi-bin/koha/opac-suggestions.pl?op=add_form you get taken to a login screen and after logging in the URL loses the ?op=add_form part of the URL which means the page you are taken to doesn't allow the addition of a new suggestion. To reproduce: 1) On the OPAC while not logged in 2) Go to ..../cgi-bin/koha/opac-suggestions.pl?op=add_form 3) Log in 4) The resulting page is ..../cgi-bin/koha/opac-suggestions.pl which doesn't allow the addition on a new suggestion -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 34438] New: OPAC self registration form does not include lang ( Preferred language for notices ) field
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34438 Bug ID: 34438 Summary: OPAC self registration form does not include lang ( Preferred language for notices ) field Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: lucas(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org To recreate: 1. Install a language pack ( sudo koha-translate -i es-ES ) 2. Turn on the system preference TranslateNotices 3. The lang field now appears when registering a patron from the staff interface but not on the OPAC self registration form. -- You are receiving this mail because: You are watching all bug changes.

1 46

[Bug 41926] New: Disable OPAC search form after first submitting it, as a counter measure to spam
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41926 Bug ID: 41926 Summary: Disable OPAC search form after first submitting it, as a counter measure to spam Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: lari.taskula(a)hypernova.fi QA Contact: testopia(a)bugs.koha-community.org We occasionally notice the same search query being placed multiple times in rapid succession. While we do ratelimiting that eventually blocks the spam (whether intentional or not), the first counter measure should be to disable the form submit by JavaScript. I propose once the search form is first submitted, we send the query and then disable the submit function. If patron then re-submits the form before search results are loaded, the browser will not send another query to Koha. Now if anything changes within the form before the results are loaded, we re-enable the submit so that if they are quick enough, they could still modify their query before the results. -- You are receiving this mail because: You are watching all bug changes.

1 8

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193714|0 |1 is obsolete| | --- Comment #231 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193968 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193968&action=e… Bug 38365: (follow-up) Move default Content-Security-Policy value into Perl module, add tests To test: 1. prove t/Koha/ContentSecurityPolicy.t Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193713|0 |1 is obsolete| | --- Comment #230 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193967 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193967&action=e… Bug 38365: (follow-up) Only get the nonce in templates if CSP is enabled, add tests To test: 1. prove t/db_dependent/Koha/Template/Plugin/Koha.t Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193712|0 |1 is obsolete| | --- Comment #229 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193966 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193966&action=e… Bug 38365: Only get the nonce in templates if CSP is enabled Signed-off-by: Lari Taskula <lari.taskula(a)hypernova.fi> Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 26 Feb '26

26 Feb '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193711|0 |1 is obsolete| | --- Comment #228 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 193965 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193965&action=e… Bug 38365: Add CSP nonces to all inline script and style tags Signed-off-by: Lari Taskula <lari.taskula(a)hypernova.fi> Signed-off-by: David Cook <dcook(a)prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.

1 0