March 2026 - Koha-bugs - lists.koha-community.org

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 04 Mar '26

04 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #244 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 194424 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=194424&action=e… Bug 38365: Replace `use strict; use warnings;` with `use Modern::Perl` -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 04 Mar '26

04 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #243 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 194423 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=194423&action=e… Bug 38365: Remove old default values from koha-conf* files -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 04 Mar '26

04 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193965|0 |1 is obsolete| | --- Comment #242 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 194422 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=194422&action=e… Bug 38365: Add CSP nonces to all inline script and style tags -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 04 Mar '26

04 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #241 from David Cook <dcook(a)prosentient.com.au> --- Ah right in the default CSP header, I don't include the report-uri or report-to... -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 41913] New: Batch patron modification only affects on patrons that are visible in the tool
by bugzilla-daemon＠bugs.koha-community.org 04 Mar '26

04 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41913 Bug ID: 41913 Summary: Batch patron modification only affects on patrons that are visible in the tool Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Tools Assignee: koha-bugs(a)lists.koha-community.org Reporter: anni.maki-mantila(a)turku.fi QA Contact: testopia(a)bugs.koha-community.org If patrons are divided to several pages in batch patron modification -tool, Koha makes the modification only to those patrons that are visible on the first page. The modification should affect on every patron that has been brought to the modification tool, regardless of how many patrons are shown per page. In version 24.05 this has worked properly. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 1

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 04 Mar '26

04 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #240 from David Cook <dcook(a)prosentient.com.au> --- (In reply to Jonathan Druart from comment #232) > 5. We will need a commit for ktd to sync koha-conf.xml I've added that at https://gitlab.com/koha-community/koha-testing-docker/-/merge_requests/579 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 04 Mar '26

04 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #239 from David Cook <dcook(a)prosentient.com.au> --- It looks like I forgot to remove the csp_header_value from etc/koha-conf.xml and debian/templates/koha-conf-site.xml.in. I'll have to remove those... -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 04 Mar '26

04 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #238 from David Cook <dcook(a)prosentient.com.au> --- Going to grab some lunch and then hook into these changes... -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 04 Mar '26

04 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #237 from David Cook <dcook(a)prosentient.com.au> --- Thanks so much for looking at this, Jonathan! (In reply to Jonathan Druart from comment #232) > 1. I think we need a xt test to parse template files and catch regressions > from Jenkins. Let me know if I miss something, I can write it if you want me > to. That would be great if you could write it. Martin mentioned doing a xt test, but I didn't understand what he (or you) mean by it. I'm sure I'll understand once I see it. > 2. `use strict; use warnings;` should be replaced by `use Modern::Perl;` I can fix that up in t/Koha/Middleware/ContentSecurityPolicy.t and t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t, which I think are the only two occurrences. > 3. Is there a good reason to use Plack::Test in > t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t? IMO we should have a > Cypress test. > By the way I am expecting t/Koha/Middleware/ContentSecurityPolicy.t to fail > if there is no DB, why is it not in db_dependent? > Also I don't think those 2 includes are needed: > 27 use File::Basename qw(dirname); > 28 use HTTP::Request::Common; I'll let Lari followup with that one. > 4. Koha::Cache::Memory::Lite; is loaded in several modules but not used. Ah yep that's from an old revision. I'll remove from Koha/ContentSecurityPolicy.pm and t/Koha/ContentSecurityPolicy.t > 5. We will need a commit for ktd to sync koha-conf.xml Is the file "files/templates/koha-conf-site.xml.in" in KTD? I can do a PR for that. > 6. xt/api.t is failing > xt/api.t .. 1/8 > # Failed test 'Validation exit code is 0' > # at xt/api.t line 103. > # got: '256' > # expected: '0' > # Validation failed. /paths/public/csp-reports/post/parameters/body has > an invalid type (array,object) > # Looks like you failed 1 test of 1. Hmm that's annoying. It works in practice but swagger-cli must not like it. Perhaps we do need separate endpoints for the different report syntaxes. @Lari: can you take care of that? > xt/api.t .. 3/8 > # Failed test 'The spec passes the swagger-cli validation' > # at xt/api.t line 108. > > # Failed test 'No tag errors in the spec' > # at xt/api.t line 130. > # Structures begin differing at: > # $got->[0] = 'post /public/csp-reports -> uses tag 'csp' not > present in top level list' > # $expected->[0] = Does not exist > post /public/csp-reports -> uses tag 'csp' not present in top level list I can look into that. > 7. When enabled, I see an error in the browser's console: > Content-Security-Policy: The page’s settings blocked the loading of a > resource (media-src) at data: because it violates the following directive: > “default-src 'self'” That's interesting. I'd like to hear more about this one. Were there additional details? I wonder if it had to do with audio when doing a checkout or something? > Might be related to the other error: > Source map error: request failed with status 404 > Resource URL: > http://dev-intra.localhost/intranet-tmpl/lib/bootstrap/bootstrap.bundle. > min_25.1200026.js > Source Map URL: bootstrap.bundle.min.js.map This is a normal error. When you have the dev tools open, it'll try to fetch the non-existence bootstrap.bundle.min.js.map file. You can safely ignore that one. > > 8. It's not clear to me why we are using an env var, I would go with a > package variable. I actually faced the same problem a couple of weeks ago on > bug 41895, please have a look at Koha/Context/UserEnv.pm in the first patch > there. Originally, I was using the cache in the Plack Middleware, but the cache gets cleared by CGI::new at the start of CGI script handling. In theory a singleton using a package variable could work. I think I used an ENV variable because I knew it would be cleared with each HTTP request, but I suppose a package variable would too. Is it a blocker? Wouldn't be too hard to switch over to using a package variable. I do like the idea of using a package variable instead as it seems cleaner. > 9. Did you discuss those 3 occurrences? > misc/cronjobs/cloud-kw.pl:<style> > misc/cronjobs/overdue_notices.pl:<style type='text/css'> > misc/cronjobs/runreport.pl: > "<html><head><style>tr:nth-child(2n+1) { background-color: > #ccc;}</style></head><body>$message</body></html>"; No, we didn't talk about them. misc/cronjobs/overdue_notices.pl and misc/cronjobs/runreport.pl aren't relevant since they're sending HTML emails so CSP doesn't apply there. But misc/cronjobs/cloud-kw.pl is interesting. I think I've wanted to remove that cronjob for many years, but I think BibLibre still use it. At a glance... it looks like that HTML file is served directly from Apache rather than being generated by Plack, so it won't be covered by CSP, but it also can't really (unless a person adds the CSP header via Apache but I think that's out of scope for this change). > 10. Vue apps have styling issues: > Content-Security-Policy: The page’s settings blocked an inline style > (style-src-elem) from being applied because it violates the following > directive: “style-src 'self' 'nonce-UrNLygw_Cc1zaPU2WH0qVk'”. Consider using > a hash ('sha256-t4I2teZN5ZH+VM+XOiWlaPbsjQHe+k9d6viXPpKpNWA=', requires > 'unsafe-hashes' for style attributes) or a nonce. > It's coming from insertBySelector.js and styleTagTransform.js I have been wondering if the Vue apps would have trouble. According to https://webpack.js.org/loaders/style-loader/#nonce, style-loader isn't recommended for production. Note the security warning on https://www.npmjs.com/package/style-loader as well. How does style-loader get used in Vue currently? > 11. Not blocker but add_csp_nonces.pl should use Koha::Devel::Files to list > files. Could you elaborate on that? > 12. > (In reply to David Cook from comment #99) > > FYI bug 38407 will need to be resolved before the staff interface is ready > > for CSP in prod. > > There is no patch there, should this depends on it then? I don't think so. However, we probably should add a warning to koha-conf.xml saying not to enable CSP for intranet until after bug 38407 is resolved. Originally, I was only intending to add the CSP mechanism, and then add CSP to the OPAC, since it was ready for it. Scope creep has taken us much further. I'll still work on bug 38407 after we push this one, but I'm keen to at least get the mechanism into Koha. > 13. I didn't manage to see something in the violation logs. I enabled > dom.reporting.* in about:config, what else is needed? As Lari said, you need to have HTTPS enabled (you can do this using the snakeoil certs on the server), to use a domain name instead of local host, and make sure report-uri is set correctly because Firefox doesn't support "report-to" yet (but Chrome and Edge use "report-to" which uses a different syntax - ugh). > Side note: This will heavily conflict with bug 41324... Easy to fix, but > boring. I think it should be OK? We can toss the "Bug 38365: Add CSP nonces to all inline script and style tags" patch and re-generate to fix the merge conflict. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 28633] New: Add a preferred_name field and an effective_name method to patrons
by bugzilla-daemon＠bugs.koha-community.org 03 Mar '26

03 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28633 Bug ID: 28633 Summary: Add a preferred_name field and an effective_name method to patrons Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Patrons Assignee: koha-bugs(a)lists.koha-community.org Reporter: nick(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com Some institutions store legal names in their directories and for patron imports, but would also like to be able to record 'preferred' names in the patro records. It would be nice to have a field for preferred_name and a method to select the preferred name when it exists, and the firstname when it doesn't Following the item we would suggest 'effective_name' - the additional method can be used in patron-title.inc and in notices to simplify name choice. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 194