March 2026 - Koha-bugs - lists.koha-community.org

[Bug 8290] Replace usage of Greybox modals with Bootstrap modals
by bugzilla-daemon＠bugs.koha-community.org 13 Mar '26

13 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8290 Marcel de Rooy <m.de.rooy(a)rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=41665 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42089] New: Able to select restricted item when placing a hold
by bugzilla-daemon＠bugs.koha-community.org 13 Mar '26

13 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42089 Bug ID: 42089 Summary: Able to select restricted item when placing a hold Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: johanna.raisa(a)koha-suomi.fi QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle(a)bywatersolutions.com Created attachment 195254 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195254&action=e… Selection is allowed for restricted items You can select a restricted item when placing a hold. Restrictions like "not for loan" or damaged are not working at the moment. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 13 Mar '26

13 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #366 from Lari Taskula <lari.taskula(a)hypernova.fi> --- (In reply to David Cook from comment #364) > It looks like t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t has a > failing test because > ./t/mock_templates/opac-tmpl/bootstrap/en/modules/opac-csp.tt contains a > newline at the start Fixed -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 13 Mar '26

13 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 Lari Taskula <lari.taskula(a)hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #195077|0 |1 is obsolete| | --- Comment #365 from Lari Taskula <lari.taskula(a)hypernova.fi> --- Created attachment 195249 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195249&action=e… Bug 38365: Adjust t/mock_templates/opac-tmpl/bootstrap/en/modules/opac-csp.tt This file now tidies after the patch "Make tidy.pl compatible with script elements with attributes" To test: 1. prove t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 23290] XSLT system preferences allow administrators to exploit XML and XSLT vulnerabilities
by bugzilla-daemon＠bugs.koha-community.org 13 Mar '26

13 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23290 --- Comment #118 from David Cook <dcook(a)prosentient.com.au> --- In December 2025, a bug with XML External Entity injection was found in Apache Tika. So there's a non-Koha example of how expanding external XML entities is not good. That vulnerability is referred to as the following: CWE-611: Improper Restriction of XML External Entity Reference -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 41094] New: search_anonymize_candidates returns too many candidates when FailedLoginAttempts is empty
by bugzilla-daemon＠bugs.koha-community.org 13 Mar '26

13 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41094 Bug ID: 41094 Summary: search_anonymize_candidates returns too many candidates when FailedLoginAttempts is empty Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Patrons Assignee: koha-bugs(a)lists.koha-community.org Reporter: m.de.rooy(a)rijksmuseum.nl QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle(a)bywatersolutions.com >From a discussion on Mattermost with David Little. The arguable lines are: my $fails = C4::Context->preference('FailedLoginAttempts') || 0; $cond->{login_attempts} = [ -and => { '!=' => undef }, { -not_in => [ 0, 1 .. $fails - 1 ] } ]; -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 35

[Bug 41591] XSS vulnerability via file upload function for invoices
by bugzilla-daemon＠bugs.koha-community.org 13 Mar '26

13 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41591 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |42080 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42080 [Bug 42080] Invoice PDFs are forced downloads -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 13 Mar '26

13 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #364 from David Cook <dcook(a)prosentient.com.au> --- It looks like t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t has a failing test because ./t/mock_templates/opac-tmpl/bootstrap/en/modules/opac-csp.tt contains a newline at the start The adjustment for this would be to either chomp the space in the template or to add the newline in the test expected output. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 13 Mar '26

13 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #363 from David Cook <dcook(a)prosentient.com.au> --- Getting a little merge conflict: diff --cc koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt index 06fd4041770,5b793bc5cbd..00000000000 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt @@@ -1824,7 -1824,7 +1824,11 @@@ // Set the first navigation link as active $(covernav).addClass("nav-active"); } ++<<<<<<< HEAD + $(covernav).html('<i class="fa fa-circle" aria-hidden="true"></i>'); ++======= + $(covernav).html('<i class="fa fa-circle"></i>'); ++>>>>>>> Bug 38365: Add CSP nonces to all inline script and style tags $(coverSlide).append(covernav); }); } It looks like it's due to the patch "Bug 41582: (RM follow-up) Add missing aria-hidden attribute to FA icon" I'm guessing either Jonathan can rebase or Lucas might fix that one up? -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 13 Mar '26

13 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #362 from David Cook <dcook(a)prosentient.com.au> --- (In reply to Jonathan Druart from comment #360) > All but one bug under bug 41324 is ready to be pushed, and the conflict with > this (bug 38365) is huge. As we have a patch to regenerate the patch "Add > CSP nonces to all inline script and style tags" I am going to rebase this > patchset on top of it. Thanks for that :) -- You are receiving this mail because: You are watching all bug changes.

1 0