March 2026 - Koha-bugs - lists.koha-community.org

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 03 Mar '26

03 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #235 from Lari Taskula <lari.taskula(a)hypernova.fi> --- Thanks Jonathan for taking a look at this :) (In reply to Jonathan Druart from comment #234) > (In reply to Jonathan Druart from comment #232) > > 3. Is there a good reason to use Plack::Test in > > t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t? IMO we should have a > > Cypress test. > > Oh, it won't work with Cypress because you want to mock the config. I was initially looking for a way to test the feature without actually enabling the CSP middleware outside of this test. The initial plan was to enable CSP for OPAC alone. As this Bug evolved we are now activating the middleware in both interfaces (although not yet enabling the feature of course). As for why not cypress tests in particular, I have simply not written them before and am not aware of its limitations. As long as we can test this with different configurations coming namely from KOHA_CONF, I'm not demanding to use any particular testing framework. I can see cypress tests being very useful for verifying the absence of CSP errors on various different pages in Koha. > 13. I didn't manage to see something in the violation logs. I enabled dom.reporting.* in about:config, what else is needed? Is that Firefox? Firefox only supports report-uri (not report-to + Reporting-Endpoints response header) so first make sure that report-uri is defined in your KOHA_CONF. Also https should be enabled for the browsers to become willing to send reports. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14962] Temp Shelving Location / On Display Module
by bugzilla-daemon＠bugs.koha-community.org 03 Mar '26

03 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14962 Jake Deery <jake.deery(a)openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |41976 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41976 [Bug 41976] [Vue] LinkWrapper.vue isn't scoped properly -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 41973] New: Remove C4::Context from Koha::Config::SysPref
by bugzilla-daemon＠bugs.koha-community.org 03 Mar '26

03 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41973 Bug ID: 41973 Summary: Remove C4::Context from Koha::Config::SysPref Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: jonathan.druart(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Blocks: 41891 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41891 [Bug 41891] Move C4::Context->preferences to a separate package -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 3

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 03 Mar '26

03 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #234 from Jonathan Druart <jonathan.druart(a)gmail.com> --- (In reply to Jonathan Druart from comment #232) > 3. Is there a good reason to use Plack::Test in > t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t? IMO we should have a > Cypress test. Oh, it won't work with Cypress because you want to mock the config. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 03 Mar '26

03 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #233 from Jonathan Druart <jonathan.druart(a)gmail.com> --- Created attachment 194374 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=194374&action=e… Bug 38365: Fix new_line_at_the_end_of_file QA failure [FAIL] api/v1/swagger/definitions/csp_report.yaml FAIL new_line_at_the_end_of_file Missing new line at the end of file, make sure your editor correctly reads .editorconfig ('insert_final_newline = true'). See bug 40541. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 03 Mar '26

03 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 Jonathan Druart <jonathan.druart(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Failed QA --- Comment #232 from Jonathan Druart <jonathan.druart(a)gmail.com> --- 1. I think we need a xt test to parse template files and catch regressions from Jenkins. Let me know if I miss something, I can write it if you want me to. 2. `use strict; use warnings;` should be replaced by `use Modern::Perl;` 3. Is there a good reason to use Plack::Test in t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t? IMO we should have a Cypress test. By the way I am expecting t/Koha/Middleware/ContentSecurityPolicy.t to fail if there is no DB, why is it not in db_dependent? Also I don't think those 2 includes are needed: 27 use File::Basename qw(dirname); 28 use HTTP::Request::Common; 4. Koha::Cache::Memory::Lite; is loaded in several modules but not used. 5. We will need a commit for ktd to sync koha-conf.xml 6. xt/api.t is failing xt/api.t .. 1/8 # Failed test 'Validation exit code is 0' # at xt/api.t line 103. # got: '256' # expected: '0' # Validation failed. /paths/public/csp-reports/post/parameters/body has an invalid type (array,object) # Looks like you failed 1 test of 1. xt/api.t .. 3/8 # Failed test 'The spec passes the swagger-cli validation' # at xt/api.t line 108. # Failed test 'No tag errors in the spec' # at xt/api.t line 130. # Structures begin differing at: # $got->[0] = 'post /public/csp-reports -> uses tag 'csp' not present in top level list' # $expected->[0] = Does not exist post /public/csp-reports -> uses tag 'csp' not present in top level list 7. When enabled, I see an error in the browser's console: Content-Security-Policy: The page’s settings blocked the loading of a resource (media-src) at data: because it violates the following directive: “default-src 'self'” Might be related to the other error: Source map error: request failed with status 404 Resource URL: http://dev-intra.localhost/intranet-tmpl/lib/bootstrap/bootstrap.bundle.min… Source Map URL: bootstrap.bundle.min.js.map 8. It's not clear to me why we are using an env var, I would go with a package variable. I actually faced the same problem a couple of weeks ago on bug 41895, please have a look at Koha/Context/UserEnv.pm in the first patch there. 9. Did you discuss those 3 occurrences? misc/cronjobs/cloud-kw.pl:<style> misc/cronjobs/overdue_notices.pl:<style type='text/css'> misc/cronjobs/runreport.pl: "<html><head><style>tr:nth-child(2n+1) { background-color: #ccc;}</style></head><body>$message</body></html>"; 10. Vue apps have styling issues: Content-Security-Policy: The page’s settings blocked an inline style (style-src-elem) from being applied because it violates the following directive: “style-src 'self' 'nonce-UrNLygw_Cc1zaPU2WH0qVk'”. Consider using a hash ('sha256-t4I2teZN5ZH+VM+XOiWlaPbsjQHe+k9d6viXPpKpNWA=', requires 'unsafe-hashes' for style attributes) or a nonce. It's coming from insertBySelector.js and styleTagTransform.js 11. Not blocker but add_csp_nonces.pl should use Koha::Devel::Files to list files. 12. (In reply to David Cook from comment #99) > FYI bug 38407 will need to be resolved before the staff interface is ready > for CSP in prod. There is no patch there, should this depends on it then? 13. I didn't manage to see something in the violation logs. I enabled dom.reporting.* in about:config, what else is needed? Side note: This will heavily conflict with bug 41324... Easy to fix, but boring. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 20170] New: Clicking Reregistration Link Causes Enrollment Periods to Stack
by bugzilla-daemon＠bugs.koha-community.org 03 Mar '26

03 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20170 Bug ID: 20170 Summary: Clicking Reregistration Link Causes Enrollment Periods to Stack Change sponsored?: --- Product: Koha Version: 17.05 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Patrons Assignee: koha-bugs(a)lists.koha-community.org Reporter: cslone(a)camdencountylibrary.org QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com If you renew a patron's registration by using the 'Renew' link that is displayed after the expiration warning on the checkout screen, and you click said link more than once, the dateexpiry gets changed and extended a requisite number of times. In other words, if your enrollment period is two years and you double-click this link, the new expiration date will be end up being four years from today. If you triple click it, it will be 6 years. Quadruple click it for 8 years. (It's not possible to do this using the dropdown renewal option as it produces a dialogue box asking for the user to confirm the registration renewal.) To replicate: 1.) Create or select a patron category that has an enrollment period that is calculated in months (not a fixed date, for this example I use 24 months 2.) Find or create a patron in that category with an expired account 3.) Open this patron's account for checkout and find the warning about the patron's expired account 4.) Double click 'Renew' 5.) When the page reloads confirm that the expiration date is now 48 months from today (rather than the 24 dictated by the category enrollment period) -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 7

[Bug 25680] New: When adding a new patron and missing to fill a field, on saving, the invalidFocus should show the focused field clearly in view.
by bugzilla-daemon＠bugs.koha-community.org 03 Mar '26

03 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25680 Bug ID: 25680 Summary: When adding a new patron and missing to fill a field, on saving, the invalidFocus should show the focused field clearly in view. Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Patrons Assignee: koha-bugs(a)lists.koha-community.org Reporter: timothy_alexis.vass(a)ub.lu.se QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com Created attachment 105571 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=105571&action=e… Expected result: The focused field being clearly in view. Steps to reproduce: login: demo password: demo - http://koha.adminkuhn.ch:8080/cgi-bin/koha/members/memberentry.pl?op=add&ca… - Fill in Surname and Save. Result: Focus is set on input with id="cardnumber". Bug: The object is out of view. Expected result: The focused field being clearly in view. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 25

[Bug 41291] New: Add ability to have multiple self registration forms
by bugzilla-daemon＠bugs.koha-community.org 02 Mar '26

02 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41291 Bug ID: 41291 Summary: Add ability to have multiple self registration forms Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: lucas(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org Some libraries require multiple self registration forms with different visible fields and different required fields. -- You are receiving this mail because: You are watching all bug changes.

1 2

[Bug 41968] New: columns_settings.pl does not have any configuration for the issues table in the borrower details table
by bugzilla-daemon＠bugs.koha-community.org 02 Mar '26

02 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41968 Bug ID: 41968 Summary: columns_settings.pl does not have any configuration for the issues table in the borrower details table Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: System Administration Assignee: koha-bugs(a)lists.koha-community.org Reporter: cbrannon(a)cdalibrary.org QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com I can set settings for issues-table in columns_settings.pl, but there is no table configuration for the issues table in the details page for borrowers. The table on moremember.pl is configurable, but it is missing some column configurations that are on the checkout (circulation.pl) page. For example, I can turn off the checkin column on circulation.pl, but not on moremember.pl. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 2