March 2026 - Koha-bugs - lists.koha-community.org

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 11 Mar '26

11 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #357 from David Cook <dcook(a)prosentient.com.au> --- (In reply to David Cook from comment #356) > Once bug 38365 is pushed, we can require that people add nonces to <script> > and <style> inline elements (the QA tools will alert to this). > > And then I'll continue the work on bug 38407. Since the value builders are > handled by Koha::FrameworkPlugin, that leaves only about 117 lines across 33 > files, which isn't too bad at all. (But I agree is out of scope for bug > 38365, which is big enough already.) Actually maybe some plugins do still have some inline event handlers. I'll deal with this too though. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 11 Mar '26

11 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #356 from David Cook <dcook(a)prosentient.com.au> --- (In reply to Lari Taskula from comment #325) > (In reply to David Cook from comment #315) > > Created attachment 194607 [details] [review] [review] > > Bug 38365: Fix t/db_dependent/Koha/Plugins/Valuebuilder_hooks.t > > > > This initialises the CSP nonce in the unit test so that > > t/lib/plugins/Koha/Plugin/TestValuebuilder/test_valuebuilder_popup.tt > > will get its script element rewritten correctly. > > Do we still need this patch after excluding test_valuebuilder_popup.tt in > Koha::Devel::Files and xt/find-missing-nonce.t? Yes. It's used by t/lib/plugins/Koha/Plugin/TestValuebuilder.pm > Is there a way to make Valuebuilder_hooks.t test fail in the first place? I > tried rebasing before and after this commit but it always passed, so I don't > understand the purpose of this change and the patch. Yes, if you comment out these lines: use Koha::ContentSecurityPolicy; my $csp = Koha::ContentSecurityPolicy->new; $csp->set_nonce(); Then it will fail. There must've been an issue with your rebase I'm guessing. > `add_csp_nonces.pl --apply` still modifies test_valuebuilder_popup.tt. > Should we call its Koha::Devel::Files constructor with context => 'nonce' so > that test_valuebuilder_popup.tt will not be modified by the script? Good catch. I'll fix that. > (In reply to David Cook from comment #316) > > Created attachment 194608 [details] [review] [review] > > Bug 38365: Make tidy.pl compatible with script elements with attributes > > > > tidy.pl will still tidy whitespace around script elements that have > > attributes like "nonce" > > OK. `perl misc/devel/tidy.pl --tt` changes > t/mock_templates/opac-tmpl/bootstrap/en/modules/opac-csp.tt (file introduced > in this bug). > > (In reply to David Cook from comment #317) > > Created attachment 194609 [details] [review] [review] > > Bug 38365: Set __webpack_nonce__ for style-loader plugin and fix fontawesome > > imports > This is out of my expertise, how to test? My bad. I thought that I wrote a test plan for it. You need to rebuild the resources, turn on ERM, and visit the ERM home. Steps: 1. perl build-resources.PL (this is part of the "important" test plan) 2. Enable syspref ERMModule 3. Go to http://localhost:8081/cgi-bin/koha/erm/home 4. Note that no CSP violations appear in the console > Not to take anything away from the good work and important findings on the > staff client side as seen in that patch, but we should redefine the scope of > this Bug. It is clear from the title of this Bug [1] that the scope has been > expanding. It has also been established that CSP is not ready to be enabled > in the staff client and my understanding is that a lot of work remains to be > done there. But as far as we know OPAC is quite close. So my question is how > much do we want to (and can) work on the staff client side of things in this > Bug? > > We have a library that is willing to enable this on the OPAC side. In fact > they are already running an older implementation but we would like to see it > replaced with this one. Having this tested in the real world would be good > even if it was initially just OPAC. > > I also fear that we might run out of steam if this Bug's scope expands too > much into the staff client as well. > > [1] (at the time of this comment the title is "Add Content-Security-Policy > HTTP header to HTML responses") Yeah, I think this is as far as we go for bug 38365. We sign this off, QA it, and push it as is. -- Once bug 38365 is pushed, we can require that people add nonces to <script> and <style> inline elements (the QA tools will alert to this). And then I'll continue the work on bug 38407. Since the value builders are handled by Koha::FrameworkPlugin, that leaves only about 117 lines across 33 files, which isn't too bad at all. (But I agree is out of scope for bug 38365, which is big enough already.) -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 39906] Add bot challenge (in Apache layer)
by bugzilla-daemon＠bugs.koha-community.org 11 Mar '26

11 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39906 Aleisha Amohia <aleisha(a)catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |42065 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42065 [Bug 42065] Add errors/404.pl to Apache bot challenge -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 34594] New: Incorrect table name in OpacHiddenItems causes searches to fail or details not to display
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34594 Bug ID: 34594 Summary: Incorrect table name in OpacHiddenItems causes searches to fail or details not to display Change sponsored?: --- Product: Koha Version: 22.11 Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: wizzyrea(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Example case: Library put damage: [1,2] and searches failed with the following error: [2023/08/22 14:19:05] [WARN] No method count found for Koha::Items DBIx::Class::Storage::DBI::_dbh_execute(): DBI Exception: DBD::mysql::st execute failed: Unknown column 'me.damage' in 'where clause' at /usr/share/koha/lib/Koha/Objects.pm line 578 It would be so nice to fix this so that invalid configurations are ignored, or the preference could check upon save to verify the values input are valid. -- You are receiving this mail because: You are watching all bug changes.

1 6

[Bug 22730] New: Not possible to set default value for patron attributes
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22730 Bug ID: 22730 Summary: Not possible to set default value for patron attributes Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Patrons Assignee: koha-bugs(a)lists.koha-community.org Reporter: rhouk(a)ottumwapubliclibrary.org QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com Target Milestone: --- It would be helpful to be able define default values for patron attributes. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 9

[Bug 42059] New: Allow Connexion import utility to specify a file name to distinguish staged batches
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42059 Bug ID: 42059 Summary: Allow Connexion import utility to specify a file name to distinguish staged batches Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: MARC Bibliographic record staging/import Assignee: koha-bugs(a)lists.koha-community.org Reporter: JBoyer(a)equinoxOLI.org QA Contact: testopia(a)bugs.koha-community.org If a system has multiple libraries that use the Connexion import utility and stage their records, all record imports will be placed in the same unnamed staged batch until it is imported or cleaned / deleted. This can cause records from multiple libraries to end up in one big pile that confused catalogers may import or remove all at once even if further scrutiny is needed (otherwise they would just use the direct import method). I'd like to allow the importer to specify a filename; either a static string or one with very basic dynamic elements such as a timestamp or a simple counter. This would require multiple instances of the importer with different configs to use multiple names, but that may already be the case if a system uses one port for staged imports and another for direct, etc. If no import filename is specified in the config everything should continue to behave it does today. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 1

[Bug 20946] New: Cannot pay fines for patrons with credits
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20946 Bug ID: 20946 Summary: Cannot pay fines for patrons with credits Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Fines and fees Assignee: koha-bugs(a)lists.koha-community.org Reporter: nick(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org To recreate: 1 - Add a $5 credit to a patron 2 - Add a $1 fine 3 - Try to pay all fines 4 - You will be told to enter a value less than or equal to -4.00 5 - Observe you cannot do that -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 40

[Bug 20817] New: Acquisitions development - Ordering existing items
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20817 Bug ID: 20817 Summary: Acquisitions development - Ordering existing items Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: kyle(a)bywatersolutions.com Reporter: kyle(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org Acquisitions: attaching orders to existing records while retaining 9xx information. -- You are receiving this mail because: You are watching all bug changes.

1 162

[Bug 17506] New: Offline circ needs to be logged
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17506 Bug ID: 17506 Summary: Offline circ needs to be logged Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: cbrannon(a)cdalibrary.org QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com I recently spent about an hour and a half going over logs trying to figure out why old checkouts were showing up on patron records, and the logs were not lining up. We finally came to the assumption that someone uploaded an old offline circ file. Unfortunately, there is nothing in the logs to record offline circ transactions, and nothing tied to the specific checkouts either. It would REALLY be helpful if the logs would record offline circ transactions, including date of upload, and date of the transaction. It would also be helpful if the item history would indicate a transaction through offline circ and when the transaction was processed. It would be really cool if I could get that hour and a half back. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 33

[Bug 39266] New: Place ILL request to partners is broken
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39266 Bug ID: 39266 Summary: Place ILL request to partners is broken Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: ILL Assignee: koha-bugs(a)lists.koha-community.org Reporter: mathsabypro(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org CC: pedro.amorim(a)ptfs-europe.com, tomascohen(a)gmail.com To reproduce : activate ILLModule syspref Keep ILLPartnerCode syspref to "Inter-Library loan" value Create a patron of the category "Inter-Library loan" Create an ILL request Click on "Place request on partners" The list of partners will be blank when you should see the previously created patron -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 5