March 2026 - Koha-bugs - lists.koha-community.org

[Bug 41205] New: Error in Advanced Cataloging editor when z39 source returns undef / empty records
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41205 Bug ID: 41205 Summary: Error in Advanced Cataloging editor when z39 source returns undef / empty records Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Cataloging Assignee: koha-bugs(a)lists.koha-community.org Reporter: nick(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: m.de.rooy(a)rijksmuseum.nl To recreate: 1 - Have LOC defined as a Z39 Source (standard in KTD) 2 - Open the advanced editor 3 - Search for ISBN 9780520401129 4 - Search explodes, logs like: AH01215: stderr from /kohadevbox/koha/svc/cataloguing/metasearch: Can't call method "raw" on an undefined value at /kohadevbox/koha/Koha/MetaSearcher.pm line 267., referer: http://localhost:8081/cgi-bin/koha/cataloguing/editor.pl AH01215: stderr from /kohadevbox/koha/svc/cataloguing/metasearch: Magic number checking on storable file failed at /usr/lib/x86_64-linux-gnu/perl/5.36/Storable.pm line 443, at /kohadevbox/koha/Koha/MetaSearcher.pm line 144., referer: http://localhost:8081/cgi-bin/koha/cataloguing/editor.pl -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 18

[Bug 19852] New: Add message text box in circulation for patrons does not accept HTML tags
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=19852 Bug ID: 19852 Summary: Add message text box in circulation for patrons does not accept HTML tags Change sponsored?: --- Product: Koha Version: 17.05 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Staff Client Assignee: koha-bugs(a)lists.koha-community.org Reporter: michael(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Created attachment 69958 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=69958&action=ed… result after adding HTML tags for a patron message Hi When you add a patron message in circulation.pl, the modal that appears has a text box that does not accept HTML tags. Some libraries use HTML tags in these messages to link to information in Koha and to format the display of the message (see attached). Having this modal accept HTML would allow formatting and linking in messages. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 13

[Bug 23978] New: notes field in saved reports should allow HTML
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 Bug ID: 23978 Summary: notes field in saved reports should allow HTML Change sponsored?: --- Product: Koha Version: 18.11 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Reports Assignee: koha-bugs(a)lists.koha-community.org Reporter: theod(a)lib.auth.gr QA Contact: testopia(a)bugs.koha-community.org In recent Koha 18.11, parsing of HTML tags was removed from many fields for security reasons. However, as also seen in 22938, 22702, 22501, 23194, 23683 there are places where HTML (or at leas line breaks!) are required, or the output is too messy. The 'notes' field in the "Guided reports wizard › Saved reports" displays the data that is previously entered in a textarea. However, the guided_reports_start.tt does not parse the HTML (nor line breaks), so the output in the resulting table is all in one line! As with the other patches, I propose that we allow HTML in report notes, so one can use strong/italics/colors/urls in notes, and most importantly, line breaks! -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 48

[Bug 41529] New: HTML code visible in the table listing saved reports
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41529 Bug ID: 41529 Summary: HTML code visible in the table listing saved reports Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Reports Assignee: koha-bugs(a)lists.koha-community.org Reporter: raymund.delahunty(a)outlook.com QA Contact: testopia(a)bugs.koha-community.org CC: lisette(a)bywatersolutions.com Created attachment 190917 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=190917&action=e… With and without JQuery, in 25.11 >From 25.11 Bug 23978 allows for HTML to be added to the Notes field in reports but the HTML tags appear in the reports list view, making identification of the desired report (and understanding what the report identifies) harder. This was not the case in 24:11 (for example) where using the code listed in the JQuery Library (‘Render patron messages as HTML and in Report notes’) saw the Notes column rendered with the HTML applied, not with HTML code showing. Adding this code to IntranetUserJS in 25.11 sees the Notes field in the list view rendered correctly without the HTML code visible. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 3

[Bug 41547] New: Create a template tool to give libraries control over on screen messages and modals
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41547 Bug ID: 41547 Summary: Create a template tool to give libraries control over on screen messages and modals Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: george(a)nekls.org QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle(a)bywatersolutions.com Bug 41539 adds item barcode content to the "Holds waiting" message on #circ_circulation and #pat_moremember. It occurs to me that it would be nice if the content of this message could be controlled using a template through the HTML customizations tool or through the notice and slips templates. That would allow libraries to decide what content to have in that message without a developer having to write a patch for Koha every time someone wants to add or remove content in that message. It seems that this idea could be also applied to other messages in Koha. It would be nice to give more control over the content of messages and modals to individual libraries rather than forcing all Koha users into a one-size-fits all system. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 12

[Bug 23093] New: Error during upgrade of OpacNavRight preference to Koha news
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23093 Bug ID: 23093 Summary: Error during upgrade of OpacNavRight preference to Koha news Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Tools Assignee: koha-bugs(a)lists.koha-community.org Reporter: oleonard(a)myacpl.org QA Contact: testopia(a)bugs.koha-community.org CC: testopia(a)bugs.koha-community.org Depends on: 22318 Target Milestone: --- Copied from Bug 22318: Moving the contents of OpacNavRight to opac_news fails due to improper (no?) escaping: DBD::mysql::db do failed: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'http':'https';if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src=p+' at line 1 [for Statement "INSERT INTO opac_news (branchcode, lang, title, content ) VALUES (NULL, 'OpacNavRight_en', '', ' <a class="twitter-timeline" href="https://twitter.com/ETFLibrary" data-widget-id="702160486524186624">Tweets by @ETFLibrary</a> <script>!function(d,s,id){var js,fjs=d.getElementsByTagName(s)[0],p=/^http:/.test(d.location)?'http':'https';if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src=p+"://platform.twitter.com/widgets.js";fjs.parentNode.insertBefore(js,fjs);}}(document,"script","twitter-wjs");</script> ')"] at /usr/share/koha/intranet/cgi-bin/installer/data/mysql/updatedatabase.pl line 18220. In this example, OpacNavRight contains a script to embed a Twitter timeline. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22318 [Bug 22318] Extend Koha news feature to include other content areas -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 14

[Bug 41593] New: Authenticated SQL Injection in Koha staff interface allows full database compromise
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41593 Bug ID: 41593 Summary: Authenticated SQL Injection in Koha staff interface allows full database compromise Initiative type: --- Sponsorship Seeking sponsor status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: shukrulloh70(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org An authenticated SQL Injection vulnerability was identified in the Koha staff interface. A low-privileged staff user can inject arbitrary SQL queries via a vulnerable request parameter processed by the GetDistinctValues functionality. The injection occurs due to unsafe handling of user-supplied input when constructing SQL queries without sufficient sanitization or strict validation. Successful exploitation allows an authenticated attacker to fully compromise the backend database. /cgi-bin/koha/suggestion/suggestion.pl displayby vulnerebl parameter -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 21

[Bug 39882] New: Add phone number masking option
by bugzilla-daemon＠bugs.koha-community.org 08 Apr '26

08 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39882 Bug ID: 39882 Summary: Add phone number masking option Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: lucas(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org It would be nice it we should add a mask for phone number fields. For certain things, like Twilio, it is important that a phone number gets set in an exact format. We have Maskito for date entry, we might be able to leverage that for phone numbers: https://maskito.dev/recipes/phone -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 30

[Bug 41636] New: Make sms_number_help text customizable
by bugzilla-daemon＠bugs.koha-community.org 08 Apr '26

08 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41636 Bug ID: 41636 Summary: Make sms_number_help text customizable Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Staff interface Assignee: koha-bugs(a)lists.koha-community.org Reporter: lucas(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com When adding/editing a patron there is a hint next to the SMS number field: "Please enter numbers only. Prefix the number with + or 00 if including the country code." That ins't always necessarily true. This should be an HTML customization. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 6

[Bug 41617] New: itemsearch.pl produces wrong CSV
by bugzilla-daemon＠bugs.koha-community.org 08 Apr '26

08 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41617 Bug ID: 41617 Summary: itemsearch.pl produces wrong CSV Initiative type: --- Sponsorship --- status: Product: Koha Version: 24.11 Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: tomascohen(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org I've been following the CSV generation code in Koha for security reasons, and didn't notice this particular case until now. This script generates CSV using... templates instead of Text::CSV. Besides the fact this is wrong, there's a bug in the generated CSV. Bug 40880 solved an issue with the headers, but the produced file contains things like this: ``` "First field", "Second, field", "Third" ``` the extra space after the comma makes it get interpreted like: ``` First field <space>"Second <space>field" <space>"Third" ``` -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 26