March 2026 - Koha-bugs - lists.koha-community.org

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 Lari Taskula <lari.taskula(a)hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #194610|0 |1 is obsolete| | --- Comment #328 from Lari Taskula <lari.taskula(a)hypernova.fi> --- Created attachment 195050 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195050&action=e… Bug 38365: Add CSP nonces to all inline script and style tags Signed-off-by: Lari Taskula <lari.taskula(a)hypernova.fi> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 Lari Taskula <lari.taskula(a)hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #194608|0 |1 is obsolete| | --- Comment #327 from Lari Taskula <lari.taskula(a)hypernova.fi> --- Created attachment 195049 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195049&action=e… Bug 38365: Make tidy.pl compatible with script elements with attributes tidy.pl will still tidy whitespace around script elements that have attributes like "nonce" Signed-off-by: Lari Taskula <lari.taskula(a)hypernova.fi> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #326 from Lari Taskula <lari.taskula(a)hypernova.fi> --- Created attachment 195047 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195047&action=e… Bug 38365: Adjust t/mock_templates/opac-tmpl/bootstrap/en/modules/opac-csp.tt This file now tidies after the patch "Make tidy.pl compatible with script elements with attributes" -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #325 from Lari Taskula <lari.taskula(a)hypernova.fi> --- (In reply to David Cook from comment #315) > Created attachment 194607 [details] [review] > Bug 38365: Fix t/db_dependent/Koha/Plugins/Valuebuilder_hooks.t > > This initialises the CSP nonce in the unit test so that > t/lib/plugins/Koha/Plugin/TestValuebuilder/test_valuebuilder_popup.tt > will get its script element rewritten correctly. Do we still need this patch after excluding test_valuebuilder_popup.tt in Koha::Devel::Files and xt/find-missing-nonce.t? Is there a way to make Valuebuilder_hooks.t test fail in the first place? I tried rebasing before and after this commit but it always passed, so I don't understand the purpose of this change and the patch. `add_csp_nonces.pl --apply` still modifies test_valuebuilder_popup.tt. Should we call its Koha::Devel::Files constructor with context => 'nonce' so that test_valuebuilder_popup.tt will not be modified by the script? (In reply to David Cook from comment #316) > Created attachment 194608 [details] [review] > Bug 38365: Make tidy.pl compatible with script elements with attributes > > tidy.pl will still tidy whitespace around script elements that have > attributes like "nonce" OK. `perl misc/devel/tidy.pl --tt` changes t/mock_templates/opac-tmpl/bootstrap/en/modules/opac-csp.tt (file introduced in this bug). (In reply to David Cook from comment #317) > Created attachment 194609 [details] [review] > Bug 38365: Set __webpack_nonce__ for style-loader plugin and fix fontawesome > imports This is out of my expertise, how to test? Not to take anything away from the good work and important findings on the staff client side as seen in that patch, but we should redefine the scope of this Bug. It is clear from the title of this Bug [1] that the scope has been expanding. It has also been established that CSP is not ready to be enabled in the staff client and my understanding is that a lot of work remains to be done there. But as far as we know OPAC is quite close. So my question is how much do we want to (and can) work on the staff client side of things in this Bug? We have a library that is willing to enable this on the OPAC side. In fact they are already running an older implementation but we would like to see it replaced with this one. Having this tested in the real world would be good even if it was initially just OPAC. I also fear that we might run out of steam if this Bug's scope expands too much into the staff client as well. [1] (at the time of this comment the title is "Add Content-Security-Policy HTTP header to HTML responses") -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 18922] New: Mana - Share review
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18922 Bug ID: 18922 Summary: Mana - Share review Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Web services Assignee: koha-bugs(a)lists.koha-community.org Reporter: baptiste.wojtkowski(a)biblibre.com QA Contact: testopia(a)bugs.koha-community.org This module add reviews for Mana -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 18

[Bug 38498] New: C4::Scrubber should sometimes allow "id" and "class" attributes
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38498 Bug ID: 38498 Summary: C4::Scrubber should sometimes allow "id" and "class" attributes Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: dcook(a)prosentient.com.au QA Contact: testopia(a)bugs.koha-community.org For the "note" type, it could be good to allow "id" and "class" attributes, so that *UserJS and *UserCSS can hook onto this content more easily. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 4

[Bug 40078] New: C4::Scrubber should allow for list (ul/ol and li) HTML tags
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40078 Bug ID: 40078 Summary: C4::Scrubber should allow for list (ul/ol and li) HTML tags Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: martin.renvoize(a)openfifth.co.uk QA Contact: testopia(a)bugs.koha-community.org We added support for some additional tags support in the 'note' type scrubbed fields, but we didn't expose lists. I see no security risk with allowing those tags, please correct me if I'm incorrect there, so I think we should allow these too. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 2

[Bug 40077] New: C4::Scrubber should allow for list (ul/ol and li) HTML tags
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40077 Bug ID: 40077 Summary: C4::Scrubber should allow for list (ul/ol and li) HTML tags Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: martin.renvoize(a)openfifth.co.uk QA Contact: testopia(a)bugs.koha-community.org We added support for some additional tags support in the 'note' type scrubbed fields, but we didn't expose lists. I see no security risk with allowing those tags, please correct me if I'm incorrect there, so I think we should allow these too. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 2

[Bug 36328] New: C4::Scrubber should allow more html tags
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36328 Bug ID: 36328 Summary: C4::Scrubber should allow more html tags Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: ASSIGNED Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: jonathan.druart(a)gmail.com Reporter: jonathan.druart(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Should not we allow span, div, etc. as well as existing "br b i em big small strong"? -- You are receiving this mail because: You are watching all bug changes.

1 40

[Bug 40717] New: Notes scrubber is too strict for some cases
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40717 Bug ID: 40717 Summary: Notes scrubber is too strict for some cases Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: lisette(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org Bug 31165 added scrubbing to course reserves public note Many libraries use the public note to link to courses on their website, other resources, etc. Additionally bug 33337 talks about scrubbing patron public notes, but those are also used sometimes for links, such as other patrons that can check out their items but not guarantaurs. I recommend changing it to something like what Lucas did on Bug 38960 https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=183774&action=d… which allows for some links but is not all links: a => { href => qr{^(?:https?://|/cgi-bin/|mailto:|#)}i, class => qr/^[\w\s\-_]+$/, title => 1, target => qr/^_(?:blank|self|parent|top)$/, rel => qr/^(?:nofollow|noopener|noreferrer|noindex|bookmark|tag|prev|next|up|alternate|author|help|license|search)$/, property => qr/^[\w\s]+$/, typeof => qr/^[\w\s]+$/, resource => qr/^[#\w\-_]+$/, }, -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 11