March 2026 - Koha-bugs - lists.koha-community.org

[Bug 41623] New: Missing translation string in catalogue_detail.inc (again)
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41623 Bug ID: 41623 Summary: Missing translation string in catalogue_detail.inc (again) Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: I18N/L10N Assignee: koha-bugs(a)lists.koha-community.org Reporter: caroline.cyr-la-rose(a)inlibro.com QA Contact: testopia(a)bugs.koha-community.org CC: f.demians(a)tamil.fr, jonathan.druart(a)gmail.com Jonathan did a change to the strings in bug 38450 and this change was overwritten in bug 37334. Probably a rebase error or something like that... In short, Waiting at ... since ... in the record details is not translatables since at least 25.05 (probably 24.11.08 also since both were backported to that version). To recreate: 1. Install a new langage gulp po:update --lang fr-CA ./misc/translator/translate install fr-CA 2. Place a hold 3. Check in the item on hold and confirm the hold 4. Go to the record details page --> Waiting at ... since ... is in English 5. Check the translation files cd misc/translator/po/ git grep "Waiting at" fr-CA* --> There is no "Waiting at %s, %s since %s." -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 30

[Bug 42050] New: Show Managing Library on Baskets View
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42050 Bug ID: 42050 Summary: Show Managing Library on Baskets View Initiative type: --- Sponsorship --- status: Product: Koha Version: 24.11 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Acquisitions Assignee: koha-bugs(a)lists.koha-community.org Reporter: hc(a)interleaf.ie QA Contact: testopia(a)bugs.koha-community.org Created attachment 195078 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195078&action=e… Screenshot of the described table Under Acquisitions > Vendor, the tables containing the baskets associated with specific vendors do not include a column for the basket's managing library. This would be a useful column to appear in the table and to be able to toggle as well. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 42038] New: Item Search for Claims Returned Fails if item has two lost statues, Claim was never logged
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42038 Bug ID: 42038 Summary: Item Search for Claims Returned Fails if item has two lost statues, Claim was never logged Initiative type: --- Sponsorship --- status: Product: Koha Version: 25.05 Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Searching Assignee: koha-bugs(a)lists.koha-community.org Reporter: dmeininger591(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org To replicate: 1. Check out an item 2. Change status to Long Lost 3. Submit a claims returned for that item 4. Look at the modification log and notice the claims returned was not logged 5. Use item search with the parameter Lost = Claims Returned 6. Notice the item does not appear in the results 7. Re-do the search with the parameter Lost = Claims Returned and Long Lost 8. Notice the item now appears It seems like Koha is not logging the second lost status (claims returned) and not able to search for claims returned only when an item also has a second lost status. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 4

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 Lari Taskula <lari.taskula(a)hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #195067|0 |1 is obsolete| | --- Comment #355 from Lari Taskula <lari.taskula(a)hypernova.fi> --- Created attachment 195077 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195077&action=e… Bug 38365: Adjust t/mock_templates/opac-tmpl/bootstrap/en/modules/opac-csp.tt This file now tidies after the patch "Make tidy.pl compatible with script elements with attributes" -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 Lari Taskula <lari.taskula(a)hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #195066|0 |1 is obsolete| | --- Comment #354 from Lari Taskula <lari.taskula(a)hypernova.fi> --- Created attachment 195076 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195076&action=e… Bug 38365: Add test_valuebuilder_popup.tt to the exception list -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 Lari Taskula <lari.taskula(a)hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #195065|0 |1 is obsolete| | --- Comment #353 from Lari Taskula <lari.taskula(a)hypernova.fi> --- Created attachment 195075 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195075&action=e… Bug 38365: Add CSP nonces to all inline script and style tags Signed-off-by: Lari Taskula <lari.taskula(a)hypernova.fi> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 Lari Taskula <lari.taskula(a)hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #195064|0 |1 is obsolete| | --- Comment #352 from Lari Taskula <lari.taskula(a)hypernova.fi> --- Created attachment 195074 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195074&action=e… Bug 38365: Set __webpack_nonce__ for style-loader plugin and fix fontawesome imports By setting __webpack_nonce__ webpack/rspack will add the nonce to styles added using style-loader plugin. Also, stop fontawesome from auto injecting CSS elements, and instead manually import them so that they can be picked up by style-loader -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 Lari Taskula <lari.taskula(a)hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #195063|0 |1 is obsolete| | --- Comment #351 from Lari Taskula <lari.taskula(a)hypernova.fi> --- Created attachment 195073 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195073&action=e… Bug 38365: Make tidy.pl compatible with script elements with attributes tidy.pl will still tidy whitespace around script elements that have attributes like "nonce" Signed-off-by: Lari Taskula <lari.taskula(a)hypernova.fi> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 Lari Taskula <lari.taskula(a)hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #195062|0 |1 is obsolete| | --- Comment #350 from Lari Taskula <lari.taskula(a)hypernova.fi> --- Created attachment 195072 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195072&action=e… Bug 38365: Fix t/db_dependent/Koha/Plugins/Valuebuilder_hooks.t This initialises the CSP nonce in the unit test so that t/lib/plugins/Koha/Plugin/TestValuebuilder/test_valuebuilder_popup.tt will get its script element rewritten correctly. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 Lari Taskula <lari.taskula(a)hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #195061|0 |1 is obsolete| | --- Comment #349 from Lari Taskula <lari.taskula(a)hypernova.fi> --- Created attachment 195071 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195071&action=e… Bug 38365: Make swagger-cli happy Schema type [array,object] is not valid in OpenAPI version 2. There are two different CSP reporting directives. One is the now deprecated "report-uri" directive. Browsers typically send a single JSON object following the CSP2 specification. "report-uri" is deprecated in CSP3 in favor of the newer "report-to" directive. It is expected to contain an array of report objects. There are browser that do not yet support the "report-to" directive, so both directives should be supported. There are also variations among the "report-uri" format. See https://www.tollmanz.com/content-security-policy-report-samples/ Because of these variations, it becomes quite complex to handle the most common cases in a single API endpoint. We could build two separate endpoints for both directives. Or we can accept any type of input and handle the variations in a single endpoint. This patch attempts to do that. Before this patch input parameters were validated by JSON::Validator. That is the normal and recommended way to build OpenAPI endpoints in Koha. After this patch we remove all input parameter restrictions from the OpenAPI spec, and simply accept any type of body. This means the controller will now always return a HTTP 204 regardless of the type of data passed to the controller. It instead truncates too long input before writing them into log files. As this is not an endpoint that developers will build new Koha clients for, we do not have to offer a very in-depth input parameter spec for this endpoint. To test: 1. t/db_dependent/api/v1/public/csp_reports.t -- You are receiving this mail because: You are watching all bug changes.

1 0