March 2026 - Koha-bugs - lists.koha-community.org

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '26

06 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #322 from Jonathan Druart <jonathan.druart(a)gmail.com> --- (In reply to David Cook from comment #271) > (In reply to Jonathan Druart from comment #265) > > (In reply to David Cook from comment #258) > > > (In reply to Jonathan Druart from comment #253) > > > > > > 7. When enabled, I see an error in the browser's console: > > > > > > Content-Security-Policy: The page’s settings blocked the loading of a > > > > > > resource (media-src) at data: because it violates the following directive: > > > > > > “default-src 'self'” > > > > > > > > > > That's interesting. I'd like to hear more about this one. Were there > > > > > additional details? I wonder if it had to do with audio when doing a > > > > > checkout or something? > > > > > > > > No idea! There is nothing else! Don't you see it? > > > > > > Nope! I haven't been able to find it. I don't see it anywhere. Does it > > > happen on a particular page? > > > > All pages: https://snipboard.io/if28Qu.jpg > > Yeah, I don't see that on mine: https://snipboard.io/GSboJW.jpg > > media-src is for <audio> and <video> elements, also even that violation > message looks weird, although I see other people talking about it online. Do > you have any browser plugins/extensions? I think something in your browser > is injecting audio/video into your pages. Indeed, it's NoScript! (even if disabled for the site) -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '26

06 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #321 from Jonathan Druart <jonathan.druart(a)gmail.com> --- (In reply to David Cook from comment #273) > Hmm... I looked at adding an exclusion but not sure how we do it. If we > change Koha::Devel::Files->ls_tt_files to exclude that test template, won't > we be excluding it from other scripts perhaps should include it? > > It would be good to be able to provide runtime exceptions to ls_tt_files() > and friends. > > What do you think, Jonathan? Yep, see the last patch ("Add test_valuebuilder_popup.tt to the exception list"), it's how we add exception to Koha::Devel::Files. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '26

06 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #320 from Jonathan Druart <jonathan.druart(a)gmail.com> --- Created attachment 194622 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=194622&action=e… Bug 38365: Add test_valuebuilder_popup.tt to the exception list Patch from commit 5ceefaa -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42008] New: Add information about serial to system log
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '26

06 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42008 Bug ID: 42008 Summary: Add information about serial to system log Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Serials Assignee: koha-bugs(a)lists.koha-community.org Reporter: hagud(a)orex.es QA Contact: testopia(a)bugs.koha-community.org Currently many actions in Koha generate entries in the action_logs table (circulation, cataloguing, patrons, etc.), allowing libraries to audit staff activity. However, actions related to serials receiving are not logged. When a serial issue is received through the Serials module, there is no entry in action_logs, which makes it difficult to audit who performed the action and when. This can be problematic for libraries that need traceability for serials check-in workflows. I propose adding action_logs entries when the following actions occur in the Serials module: Receiving a serial issue Undo receiving an issue (if applicable) Possibly editing or deleting a received issue The log entry should include the staff user who performed the action, consistent with other modules. This enhancement would improve auditing capabilities and bring the Serials module in line with other Koha modules that already log staff actions. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '26

06 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #319 from David Cook <dcook(a)prosentient.com.au> --- (In reply to David Cook from comment #276) > I was thinking more about Jonathan's problem... and I suspect that there's > probably some ancestors that might only live in Lari and my git repos at > this point, so I just tried applying everything on a different git repo and > sure enough... so I'll try to rebase all that... Yep, after a rebase and reupload, it's all good now. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '26

06 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #194567|0 |1 is obsolete| | --- Comment #318 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 194610 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=194610&action=e… Bug 38365: Add CSP nonces to all inline script and style tags -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '26

06 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #194479|0 |1 is obsolete| | --- Comment #317 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 194609 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=194609&action=e… Bug 38365: Set __webpack_nonce__ for style-loader plugin and fix fontawesome imports By setting __webpack_nonce__ webpack/rspack will add the nonce to styles added using style-loader plugin. Also, stop fontawesome from auto injecting CSS elements, and instead manually import them so that they can be picked up by style-loader -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '26

06 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #194478|0 |1 is obsolete| | --- Comment #316 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 194608 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=194608&action=e… Bug 38365: Make tidy.pl compatible with script elements with attributes tidy.pl will still tidy whitespace around script elements that have attributes like "nonce" -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '26

06 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #194477|0 |1 is obsolete| | --- Comment #315 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 194607 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=194607&action=e… Bug 38365: Fix t/db_dependent/Koha/Plugins/Valuebuilder_hooks.t This initialises the CSP nonce in the unit test so that t/lib/plugins/Koha/Plugin/TestValuebuilder/test_valuebuilder_popup.tt will get its script element rewritten correctly. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 06 Mar '26

06 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #194449|0 |1 is obsolete| | --- Comment #314 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 194606 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=194606&action=e… Bug 38365: Make swagger-cli happy Schema type [array,object] is not valid in OpenAPI version 2. There are two different CSP reporting directives. One is the now deprecated "report-uri" directive. Browsers typically send a single JSON object following the CSP2 specification. "report-uri" is deprecated in CSP3 in favor of the newer "report-to" directive. It is expected to contain an array of report objects. There are browser that do not yet support the "report-to" directive, so both directives should be supported. There are also variations among the "report-uri" format. See https://www.tollmanz.com/content-security-policy-report-samples/ Because of these variations, it becomes quite complex to handle the most common cases in a single API endpoint. We could build two separate endpoints for both directives. Or we can accept any type of input and handle the variations in a single endpoint. This patch attempts to do that. Before this patch input parameters were validated by JSON::Validator. That is the normal and recommended way to build OpenAPI endpoints in Koha. After this patch we remove all input parameter restrictions from the OpenAPI spec, and simply accept any type of body. This means the controller will now always return a HTTP 204 regardless of the type of data passed to the controller. It instead truncates too long input before writing them into log files. As this is not an endpoint that developers will build new Koha clients for, we do not have to offer a very in-depth input parameter spec for this endpoint. To test: 1. t/db_dependent/api/v1/public/csp_reports.t -- You are receiving this mail because: You are watching all bug changes.

1 0