March 2026 - Koha-bugs - lists.koha-community.org

[Bug 39587] New: Patron surname missing from Contact information list on moremember.tt
by bugzilla-daemon＠bugs.koha-community.org 04 Mar '26

04 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39587 Bug ID: 39587 Summary: Patron surname missing from Contact information list on moremember.tt Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Patrons Assignee: koha-bugs(a)lists.koha-community.org Reporter: lucas(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com To recreate: 1. Go to members/moremember.pl?borrowernumber=X where X is borrowernumber of a patron with a surname 2. Look under contact information and notice surname is missing. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 20

[Bug 38771] New: Typo 'AuthScuccessLog' system preference
by bugzilla-daemon＠bugs.koha-community.org 04 Mar '26

04 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38771 Bug ID: 38771 Summary: Typo 'AuthScuccessLog' system preference Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: trivial Priority: P5 - low Component: Tools Assignee: koha-bugs(a)lists.koha-community.org Reporter: roman.dolny(a)jezuici.pl QA Contact: testopia(a)bugs.koha-community.org Typo in system preference 'AuthScuccessLog' -> 'AuthSuccessLog'. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 18

[Bug 31930] New: Ignore whitespace before and after barcodes when adding items to rotating collections
by bugzilla-daemon＠bugs.koha-community.org 04 Mar '26

04 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31930 Bug ID: 31930 Summary: Ignore whitespace before and after barcodes when adding items to rotating collections Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Keywords: Academy Severity: trivial Priority: P5 - low Component: Tools Assignee: koha-bugs(a)lists.koha-community.org Reporter: katrin.fischer(a)bsz-bw.de QA Contact: testopia(a)bugs.koha-community.org When you add items to a rotating collection by copy and pasting the barcode, there will often be whitespace causing a 'barcode not found' error. We should automatically remove/ignore this leading/trailing whitespace as we do in other forms like the checkout/checkin forms. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 19

[Bug 40691] New: CCODE label not includes in case of 'wrong place' problem (and maybe others cases) into inventory.pl
by bugzilla-daemon＠bugs.koha-community.org 04 Mar '26

04 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40691 Bug ID: 40691 Summary: CCODE label not includes in case of 'wrong place' problem (and maybe others cases) into inventory.pl Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: trivial Priority: P5 - low Component: Tools Assignee: koha-bugs(a)lists.koha-community.org Reporter: thibaud.guillot(a)biblibre.com QA Contact: testopia(a)bugs.koha-community.org Hello, Just a quick fix: when you create an inventory of items and some items have “wrong place” problems, if they are associated with a collection code, the table will only display the code and not its label. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 15

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 04 Mar '26

04 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #250 from David Cook <dcook(a)prosentient.com.au> --- Thanks again for looking at this, Jonathan. I think I've covered quite a few of your points, and looking forward to your feedback to my responses :). -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 04 Mar '26

04 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #249 from David Cook <dcook(a)prosentient.com.au> --- Test plan: 0. Apply the patch 1. cp debian/templates/plack.psgi /etc/koha/sites/kohadev/plack.psgi 2. Add conf to /etc/koha/sites/kohadev/koha-conf.xml <content_security_policy> <opac> <csp_mode>report-only</csp_mode> <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'; report-uri /api/v1/public/csp-reports; report-to csp-violations</csp_header_value> </opac> <intranet> <csp_mode>report-only</csp_mode> <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'; report-uri /api/v1/public/csp-reports; report-to csp-violations</csp_header_value> </intranet> </content_security_policy> 3. Rebuild API redocly bundle --ext json api/v1/swagger/swagger.yaml --output api/v1/swagger/swagger_bundle.json 4. Add the following to /etc/koha/sites/kohadev/log4perl.conf log4perl.logger.csp = WARN, CSP log4perl.appender.CSP=Log::Log4perl::Appender::File log4perl.appender.CSP.filename=/var/log/koha/kohadev/csp-violations.log log4perl.appender.CSP.mode=append log4perl.appender.CSP.layout=PatternLayout log4perl.appender.CSP.layout.ConversionPattern=[%d] %m%n log4perl.appender.CSP.utf8=1 log4perl.logger.plack-csp = WARN, PLACKCSP log4perl.appender.PLACKCSP=Log::Log4perl::Appender::File log4perl.appender.PLACKCSP.filename=/var/log/koha/kohadev/plack-csp-violations.log log4perl.appender.PLACKCSP.mode=append log4perl.appender.PLACKCSP.layout=PatternLayout log4perl.appender.PLACKCSP.layout.ConversionPattern=[%d] %m%n log4perl.appender.PLACKCSP.utf8=1 5. Restart everything restart_all 6. Run unit tests: GIT_INSTALL=1 KOHA_HOME=/kohadevbox/koha/ prove -v t/Koha/ContentSecurityPolicy.t t/Koha/Middleware/ContentSecurityPolicy.t t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t t/db_dependent/Koha/Template/Plugin/Koha.t t/db_dependent/api/v1/public/csp_reports.t 7. Set up SSL on OPAC - sudo vi /etc/apache2/sites-enabled/kohadev.conf Add the following to the bottom of the OPAC :8080 virtualhost: SSLEngine on SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key - sudo a2enmod ssl - sudo service apache2 restart 8. Manual testing Open your F12 dev tools, go to the Console tab, and look for CSP errors as you navigate around Koha. - Go to /cgi-bin/koha/tools/additional-contents.pl?op=add_form&category=news&editmode=wysiwyg in the staff interface - Add a news item for "Staff interface and OPAC" with the following HTML: <script>console.log('boo')</script> - To test the OPAC with CSP violation reports, go to https://kohadev.mydnsname.org:8080/ - If you're not seeing reports in /var/log/koha/kohadev/plack-csp-violations.log, try using a different browser or a private/incognito window NOTE: The following is an example of Firefox and Chrome reporting (respectively) [2026/03/04 03:18:20] CSP violation: 'script-src-elem' blocked 'inline' on page 'https://kohadev.mydnsname.org:8080/' at https://kohadev.mydnsname.org:8080/:763:63 [2026/03/04 03:18:26] CSP violation: 'script-src-elem' blocked 'inline' on page 'https://kohadev.mydnsname.org:8080/' at https://kohadev.mydnsname.org:8080/:763 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 04 Mar '26

04 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #248 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 194428 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=194428&action=e… Bug 38365: Switch from using ENV to package level variable for nonce caching -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 04 Mar '26

04 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #247 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 194427 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=194427&action=e… Bug 38365: Add warning that intranet/staff interface is not ready for "enabled" mode yet -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 04 Mar '26

04 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #246 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 194426 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=194426&action=e… Bug 38365: Fix csp/csp-reports tag in API spec -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 04 Mar '26

04 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #245 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 194425 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=194425&action=e… Bug 38365: Remove old usage of Koha::Cache::Memory::Lite -- You are receiving this mail because: You are watching all bug changes.

1 0