March 2026 - Koha-bugs - lists.koha-community.org

[Bug 23290] XSLT system preferences allow administrators to exploit XML and XSLT vulnerabilities
by bugzilla-daemon＠bugs.koha-community.org 13 Mar '26

13 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23290 --- Comment #118 from David Cook <dcook(a)prosentient.com.au> --- In December 2025, a bug with XML External Entity injection was found in Apache Tika. So there's a non-Koha example of how expanding external XML entities is not good. That vulnerability is referred to as the following: CWE-611: Improper Restriction of XML External Entity Reference -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 41094] New: search_anonymize_candidates returns too many candidates when FailedLoginAttempts is empty
by bugzilla-daemon＠bugs.koha-community.org 13 Mar '26

13 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41094 Bug ID: 41094 Summary: search_anonymize_candidates returns too many candidates when FailedLoginAttempts is empty Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Patrons Assignee: koha-bugs(a)lists.koha-community.org Reporter: m.de.rooy(a)rijksmuseum.nl QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle(a)bywatersolutions.com >From a discussion on Mattermost with David Little. The arguable lines are: my $fails = C4::Context->preference('FailedLoginAttempts') || 0; $cond->{login_attempts} = [ -and => { '!=' => undef }, { -not_in => [ 0, 1 .. $fails - 1 ] } ]; -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 35

[Bug 41591] XSS vulnerability via file upload function for invoices
by bugzilla-daemon＠bugs.koha-community.org 13 Mar '26

13 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41591 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |42080 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42080 [Bug 42080] Invoice PDFs are forced downloads -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 13 Mar '26

13 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #364 from David Cook <dcook(a)prosentient.com.au> --- It looks like t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t has a failing test because ./t/mock_templates/opac-tmpl/bootstrap/en/modules/opac-csp.tt contains a newline at the start The adjustment for this would be to either chomp the space in the template or to add the newline in the test expected output. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 13 Mar '26

13 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #363 from David Cook <dcook(a)prosentient.com.au> --- Getting a little merge conflict: diff --cc koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt index 06fd4041770,5b793bc5cbd..00000000000 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt @@@ -1824,7 -1824,7 +1824,11 @@@ // Set the first navigation link as active $(covernav).addClass("nav-active"); } ++<<<<<<< HEAD + $(covernav).html('<i class="fa fa-circle" aria-hidden="true"></i>'); ++======= + $(covernav).html('<i class="fa fa-circle"></i>'); ++>>>>>>> Bug 38365: Add CSP nonces to all inline script and style tags $(coverSlide).append(covernav); }); } It looks like it's due to the patch "Bug 41582: (RM follow-up) Add missing aria-hidden attribute to FA icon" I'm guessing either Jonathan can rebase or Lucas might fix that one up? -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 13 Mar '26

13 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #362 from David Cook <dcook(a)prosentient.com.au> --- (In reply to Jonathan Druart from comment #360) > All but one bug under bug 41324 is ready to be pushed, and the conflict with > this (bug 38365) is huge. As we have a patch to regenerate the patch "Add > CSP nonces to all inline script and style tags" I am going to rebase this > patchset on top of it. Thanks for that :) -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 13 Mar '26

13 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=42080 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42086] New: Maintain position of today's and previous sections in checkouts table
by bugzilla-daemon＠bugs.koha-community.org 13 Mar '26

13 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42086 Bug ID: 42086 Summary: Maintain position of today's and previous sections in checkouts table Initiative type: --- Sponsorship --- status: Product: Koha Version: 25.11 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: maxeinergl(a)gcc.edu QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle(a)bywatersolutions.com Bug 24533 allowed items to be sorted within the Today's checkouts and Previous checkouts groupings of the checkouts table. But depending on your sort, sometimes the Today's checkouts grouping is at the top and sometimes the Previous checkouts grouping is at the top, which is confusing. I suggest that the position be fixed, that the Today's checkouts section should always come above the Previous checkouts section when using a sort that maintains these groupings. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 42079] New: Remove blank entries in items diff
by bugzilla-daemon＠bugs.koha-community.org 12 Mar '26

12 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42079 Bug ID: 42079 Summary: Remove blank entries in items diff Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: lisette(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org Similar to the work done to remove items that were blank both before and after a change for bibs and patrons, we should do the same for items. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 2

[Bug 29393] New: Ability to send emails from patron details page
by bugzilla-daemon＠bugs.koha-community.org 12 Mar '26

12 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29393 Bug ID: 29393 Summary: Ability to send emails from patron details page Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: new feature Priority: P5 - low Component: Notices Assignee: koha-bugs(a)lists.koha-community.org Reporter: alex.arnaud(a)biblibre.com QA Contact: testopia(a)bugs.koha-community.org -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 116