March 2026 - Koha-bugs - lists.koha-community.org

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 05 Mar '26

05 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Failed QA -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 05 Mar '26

05 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 05 Mar '26

05 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #263 from David Cook <dcook(a)prosentient.com.au> --- Test plan: 0. Apply the patch 1. cp debian/templates/plack.psgi /etc/koha/sites/kohadev/plack.psgi 2. Add conf to /etc/koha/sites/kohadev/koha-conf.xml <content_security_policy> <opac> <csp_mode>report-only</csp_mode> <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'; report-uri /api/v1/public/csp-reports; report-to csp-violations</csp_header_value> </opac> <intranet> <csp_mode>report-only</csp_mode> <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'; report-uri /api/v1/public/csp-reports; report-to csp-violations</csp_header_value> </intranet> </content_security_policy> 3. Rebuild resources perl build-resources.PL 4. Add the following to /etc/koha/sites/kohadev/log4perl.conf log4perl.logger.csp = WARN, CSP log4perl.appender.CSP=Log::Log4perl::Appender::File log4perl.appender.CSP.filename=/var/log/koha/kohadev/csp-violations.log log4perl.appender.CSP.mode=append log4perl.appender.CSP.layout=PatternLayout log4perl.appender.CSP.layout.ConversionPattern=[%d] %m%n log4perl.appender.CSP.utf8=1 log4perl.logger.plack-csp = WARN, PLACKCSP log4perl.appender.PLACKCSP=Log::Log4perl::Appender::File log4perl.appender.PLACKCSP.filename=/var/log/koha/kohadev/plack-csp-violations.log log4perl.appender.PLACKCSP.mode=append log4perl.appender.PLACKCSP.layout=PatternLayout log4perl.appender.PLACKCSP.layout.ConversionPattern=[%d] %m%n log4perl.appender.PLACKCSP.utf8=1 5. Restart everything restart_all 6. Run unit tests: GIT_INSTALL=1 KOHA_HOME=/kohadevbox/koha/ prove -v t/Koha/ContentSecurityPolicy.t t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t t/db_dependent/Koha/Template/Plugin/Koha.t t/db_dependent/api/v1/public/csp_reports.t 7. Set up SSL on OPAC - sudo vi /etc/apache2/sites-enabled/kohadev.conf Add the following to the bottom of the OPAC :8080 virtualhost: SSLEngine on SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key - sudo a2enmod ssl - sudo service apache2 restart 8. Manual testing Open your F12 dev tools, go to the Console tab, and look for CSP errors as you navigate around Koha. - Go to /cgi-bin/koha/tools/additional-contents.pl?op=add_form&category=news&editmode=wysiwyg in the staff interface - Add a news item for "Staff interface and OPAC" with the following HTML: <script>console.log('boo')</script> - To test the OPAC with CSP violation reports, go to https://kohadev.mydnsname.org:8080/ - If you're not seeing reports in /var/log/koha/kohadev/plack-csp-violations.log, try using a different browser or a private/incognito window NOTE: The following is an example of Firefox and Chrome reporting (respectively) [2026/03/04 03:18:20] CSP violation: 'script-src-elem' blocked 'inline' on page 'https://kohadev.mydnsname.org:8080/' at https://kohadev.mydnsname.org:8080/:763:63 [2026/03/04 03:18:26] CSP violation: 'script-src-elem' blocked 'inline' on page 'https://kohadev.mydnsname.org:8080/' at https://kohadev.mydnsname.org:8080/:763 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 05 Mar '26

05 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #262 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 194479 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=194479&action=e… Bug 38365: Set __webpack_nonce__ for style-loader plugin and fix fontawesome imports By setting __webpack_nonce__ webpack/rspack will add the nonce to styles added using style-loader plugin. Also, stop fontawesome from auto injecting CSS elements, and instead manually import them so that they can be picked up by style-loader -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 05 Mar '26

05 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #261 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 194478 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=194478&action=e… Bug 38365: Make tidy.pl compatible with script elements with attributes tidy.pl will still tidy whitespace around script elements that have attributes like "nonce" -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 05 Mar '26

05 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #260 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 194477 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=194477&action=e… Bug 38365: Fix t/db_dependent/Koha/Plugins/Valuebuilder_hooks.t This initialises the CSP nonce in the unit test so that t/lib/plugins/Koha/Plugin/TestValuebuilder/test_valuebuilder_popup.tt will get its script element rewritten correctly. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 05 Mar '26

05 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #259 from David Cook <dcook(a)prosentient.com.au> --- I think I've worked out a workaround for style-loader, but there's still an issue with how the font awesome styles are imported (without style-loader it seems). Ah yeah... in node_modules/(a)fortawesome/fontawesome-svg-core/index.js it does the following: DOCUMENT.head.insertBefore(style, beforeChild); Think we'd have to turn off the auto injecting of style using config.autoAddCss for fontawesome-svg-core and import fontawesome CSS explicitly. This seems to do the trick. I'll do a patch for that too... -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 05 Mar '26

05 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #258 from David Cook <dcook(a)prosentient.com.au> --- (In reply to Jonathan Druart from comment #253) > > > 7. When enabled, I see an error in the browser's console: > > > Content-Security-Policy: The page’s settings blocked the loading of a > > > resource (media-src) at data: because it violates the following directive: > > > “default-src 'self'” > > > > That's interesting. I'd like to hear more about this one. Were there > > additional details? I wonder if it had to do with audio when doing a > > checkout or something? > > No idea! There is nothing else! Don't you see it? Nope! I haven't been able to find it. I don't see it anywhere. Does it happen on a particular page? > Ok, however I found more: > Caught by the xt tests (and now by add_csp_nonces.pl as well) > * t/lib/plugins/Koha/Plugin/TestValuebuilder/test_valuebuilder_popup.tt So this is an interesting one. I will upload a patch for this one, but it's going to work differently to what you might expect. I'll explain more in my response to your comment about cataloguing plugins. (To test this one, you'll want to run `prove t/db_dependent/Koha/Plugins/Valuebuilder_hooks.t`) > And those ones when testing the UI: > * cataloguing/value_builder/* (oops, all cataloguing plugins are broken) > We might need to adjust the xt test and add_csp_nonces.pl to caught those > files as well. So these aren't actually broken. When I was first working on the patches, I thought they would be, but the script tags are actually already re-written by Koha/FrameworkPlugin.pm, so it adds the nonce to them. If you try out the cataloguing plugins, they should all work without any violation reports. See the patch labelled "Bug 38365: Fix nonce caching and add to framework plugin scripts". I think an argument could be made for fixing them a different way... and you just reminded me of why I used an ENV variable initially. It was for this. When the plugins get launched the CGI context gets re-set which is why I lost the cached values, but the ENV variable would persist and the package level variable are fine. > Also wondering if this one won't require adjustment: > misc/devel/tidy.pl:172 $content =~ s#\n*( > *)<script>\n*#\n$1<script>\n#g; Yeah I guess so since it won't match. I've written a patch that will cover this (as well as a future where we have other attributes like type for ESM modules or use async or defer). > > > 10. Vue apps have styling issues: > > > Content-Security-Policy: The page’s settings blocked an inline style > > > (style-src-elem) from being applied because it violates the following > > > directive: “style-src 'self' 'nonce-UrNLygw_Cc1zaPU2WH0qVk'”. Consider using > > > a hash ('sha256-t4I2teZN5ZH+VM+XOiWlaPbsjQHe+k9d6viXPpKpNWA=', requires > > > 'unsafe-hashes' for style attributes) or a nonce. > > > It's coming from insertBySelector.js and styleTagTransform.js > > > > I have been wondering if the Vue apps would have trouble. > > > > According to https://webpack.js.org/loaders/style-loader/#nonce, > > style-loader isn't recommended for production. Note the security warning on > > https://www.npmjs.com/package/style-loader as well. How does style-loader > > get used in Vue currently? > > Looks like it is used to load all the inline style tags. > > Todo - Vue apps are broken. > Todo - Adjust xt test to parse .vue files(?) Since style-loader isn't recommended for prod use, I think we look at replacing that. It looks like "mini-css-extract-plugin" is typically what's used which will put the CSS into a separate file. Note that nothing is broken per se. We're not turning on CSP by default, and you can always override the default CSP to allow inline styles if you want. So we have time to work out some of these changes while still forging ahead. I see what you mean though. If I turn on ERM and go to http://localhost:8081/cgi-bin/koha/erm/home I see a lot of inline style violations. Alternatively, I think that style-loader might have support for __webpack_nonce__ . I need to have a very late lunch but I'll check that out too... > Ok, will try again later, when the other points will be resolved. If you check out my latest test plan (marked important) it should give you all the steps to get reports in the logs. > > > Side note: This will heavily conflict with bug 41324... Easy to fix, but > > > boring. > > > > I think it should be OK? We can toss the "Bug 38365: Add CSP nonces to all > > inline script and style tags" patch and re-generate to fix the merge > > conflict. > > If this one passes first it will be messy, but I am inclined to do the dirty > job. Ah I think that I understand now. Happy to give you a hand with that too. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 41167] New: Rewrite Rules missing in TAR packages
by bugzilla-daemon＠bugs.koha-community.org 05 Mar '26

05 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41167 Bug ID: 41167 Summary: Rewrite Rules missing in TAR packages Initiative type: --- Sponsorship --- status: Product: Koha Version: 25.05 Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Installation and upgrade (command-line installer) Assignee: koha-bugs(a)lists.koha-community.org Reporter: vivek.openlx(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org CC: tomascohen(a)gmail.com Dear Koha Team, In the Koha 25.05.x version, I noticed that the file koha-httpd.conf in the tarball (or Git-based) installation is missing several important rewrite rules under the intranet section. Because of this, when Koha is installed from source (tar or Git), many modules on the staff interface (such as Acquisitions) do not function correctly. However, when Koha is installed via APT packages, the correct koha-httpd.conf file is included, and everything works properly. The following rewrite rules are missing and should be added: RewriteRule ^/cgi-bin/koha/erm/.$ /cgi-bin/koha/erm/erm.pl [PT] RewriteCond %{REQUEST_URI} !^/cgi-bin/koha/preservation/..pl$ RewriteRule ^/cgi-bin/koha/preservation/.$ /cgi-bin/koha/preservation/home.pl [PT] RewriteRule ^/cgi-bin/koha/admin/record_sources(.)?$ /cgi-bin/koha/admin/record_sources.pl$1 [PT] RewriteCond %{QUERY_STRING} booksellerid=(.) RewriteRule ^/cgi-bin/koha/acqui/supplier.pl$ /cgi-bin/koha/acquisition/vendors/%1? [R] RewriteRule ^/cgi-bin/koha/acquisition/vendors(.)?$ /cgi-bin/koha/acqui/vendors.pl$1 [PT] Please include these rules in the official koha-httpd.conf source TAR package file for future releases to ensure full functionality when Koha is installed from the tarball or Git source. Thank you for your attention to this issue. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 38

[Bug 41591] XSS vulnerability via file upload function for invoices
by bugzilla-daemon＠bugs.koha-community.org 05 Mar '26

05 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41591 Wainui Witika-Park <wainuiwitikapark(a)catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |wainuiwitikapark(a)catalyst.n | |et.nz Status|Pushed to oldstable |Needs documenting -- You are receiving this mail because: You are watching all bug changes.

1 0