March 2026 - Koha-bugs - lists.koha-community.org

[Bug 42065] New: Add errors/404.pl to Apache bot challenge
by bugzilla-daemon＠bugs.koha-community.org 11 Mar '26

11 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42065 Bug ID: 42065 Summary: Add errors/404.pl to Apache bot challenge Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: aleisha(a)catalyst.net.nz QA Contact: testopia(a)bugs.koha-community.org Bots have been known to spam an error page just to overload the site. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 3

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 11 Mar '26

11 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #359 from David Cook <dcook(a)prosentient.com.au> --- I'm considering this Signed Off now. Jonathan, how are you feeling in terms of QA? -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 11 Mar '26

11 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #358 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 195107 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195107&action=e… Bug 38365: Add context to Koha::Devel::Files in add_csp_nonces.pl The add_csp_nonces.pl file should use the exceptions in Koha::Devel::Files. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 11 Mar '26

11 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 11 Mar '26

11 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #357 from David Cook <dcook(a)prosentient.com.au> --- (In reply to David Cook from comment #356) > Once bug 38365 is pushed, we can require that people add nonces to <script> > and <style> inline elements (the QA tools will alert to this). > > And then I'll continue the work on bug 38407. Since the value builders are > handled by Koha::FrameworkPlugin, that leaves only about 117 lines across 33 > files, which isn't too bad at all. (But I agree is out of scope for bug > 38365, which is big enough already.) Actually maybe some plugins do still have some inline event handlers. I'll deal with this too though. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 11 Mar '26

11 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #356 from David Cook <dcook(a)prosentient.com.au> --- (In reply to Lari Taskula from comment #325) > (In reply to David Cook from comment #315) > > Created attachment 194607 [details] [review] [review] > > Bug 38365: Fix t/db_dependent/Koha/Plugins/Valuebuilder_hooks.t > > > > This initialises the CSP nonce in the unit test so that > > t/lib/plugins/Koha/Plugin/TestValuebuilder/test_valuebuilder_popup.tt > > will get its script element rewritten correctly. > > Do we still need this patch after excluding test_valuebuilder_popup.tt in > Koha::Devel::Files and xt/find-missing-nonce.t? Yes. It's used by t/lib/plugins/Koha/Plugin/TestValuebuilder.pm > Is there a way to make Valuebuilder_hooks.t test fail in the first place? I > tried rebasing before and after this commit but it always passed, so I don't > understand the purpose of this change and the patch. Yes, if you comment out these lines: use Koha::ContentSecurityPolicy; my $csp = Koha::ContentSecurityPolicy->new; $csp->set_nonce(); Then it will fail. There must've been an issue with your rebase I'm guessing. > `add_csp_nonces.pl --apply` still modifies test_valuebuilder_popup.tt. > Should we call its Koha::Devel::Files constructor with context => 'nonce' so > that test_valuebuilder_popup.tt will not be modified by the script? Good catch. I'll fix that. > (In reply to David Cook from comment #316) > > Created attachment 194608 [details] [review] [review] > > Bug 38365: Make tidy.pl compatible with script elements with attributes > > > > tidy.pl will still tidy whitespace around script elements that have > > attributes like "nonce" > > OK. `perl misc/devel/tidy.pl --tt` changes > t/mock_templates/opac-tmpl/bootstrap/en/modules/opac-csp.tt (file introduced > in this bug). > > (In reply to David Cook from comment #317) > > Created attachment 194609 [details] [review] [review] > > Bug 38365: Set __webpack_nonce__ for style-loader plugin and fix fontawesome > > imports > This is out of my expertise, how to test? My bad. I thought that I wrote a test plan for it. You need to rebuild the resources, turn on ERM, and visit the ERM home. Steps: 1. perl build-resources.PL (this is part of the "important" test plan) 2. Enable syspref ERMModule 3. Go to http://localhost:8081/cgi-bin/koha/erm/home 4. Note that no CSP violations appear in the console > Not to take anything away from the good work and important findings on the > staff client side as seen in that patch, but we should redefine the scope of > this Bug. It is clear from the title of this Bug [1] that the scope has been > expanding. It has also been established that CSP is not ready to be enabled > in the staff client and my understanding is that a lot of work remains to be > done there. But as far as we know OPAC is quite close. So my question is how > much do we want to (and can) work on the staff client side of things in this > Bug? > > We have a library that is willing to enable this on the OPAC side. In fact > they are already running an older implementation but we would like to see it > replaced with this one. Having this tested in the real world would be good > even if it was initially just OPAC. > > I also fear that we might run out of steam if this Bug's scope expands too > much into the staff client as well. > > [1] (at the time of this comment the title is "Add Content-Security-Policy > HTTP header to HTML responses") Yeah, I think this is as far as we go for bug 38365. We sign this off, QA it, and push it as is. -- Once bug 38365 is pushed, we can require that people add nonces to <script> and <style> inline elements (the QA tools will alert to this). And then I'll continue the work on bug 38407. Since the value builders are handled by Koha::FrameworkPlugin, that leaves only about 117 lines across 33 files, which isn't too bad at all. (But I agree is out of scope for bug 38365, which is big enough already.) -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 39906] Add bot challenge (in Apache layer)
by bugzilla-daemon＠bugs.koha-community.org 11 Mar '26

11 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39906 Aleisha Amohia <aleisha(a)catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |42065 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42065 [Bug 42065] Add errors/404.pl to Apache bot challenge -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42059] New: Allow Connexion import utility to specify a file name to distinguish staged batches
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42059 Bug ID: 42059 Summary: Allow Connexion import utility to specify a file name to distinguish staged batches Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: MARC Bibliographic record staging/import Assignee: koha-bugs(a)lists.koha-community.org Reporter: JBoyer(a)equinoxOLI.org QA Contact: testopia(a)bugs.koha-community.org If a system has multiple libraries that use the Connexion import utility and stage their records, all record imports will be placed in the same unnamed staged batch until it is imported or cleaned / deleted. This can cause records from multiple libraries to end up in one big pile that confused catalogers may import or remove all at once even if further scrutiny is needed (otherwise they would just use the direct import method). I'd like to allow the importer to specify a filename; either a static string or one with very basic dynamic elements such as a timestamp or a simple counter. This would require multiple instances of the importer with different configs to use multiple names, but that may already be the case if a system uses one port for staged imports and another for direct, etc. If no import filename is specified in the config everything should continue to behave it does today. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 1

[Bug 20946] New: Cannot pay fines for patrons with credits
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20946 Bug ID: 20946 Summary: Cannot pay fines for patrons with credits Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Fines and fees Assignee: koha-bugs(a)lists.koha-community.org Reporter: nick(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org To recreate: 1 - Add a $5 credit to a patron 2 - Add a $1 fine 3 - Try to pay all fines 4 - You will be told to enter a value less than or equal to -4.00 5 - Observe you cannot do that -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 40

[Bug 20817] New: Acquisitions development - Ordering existing items
by bugzilla-daemon＠bugs.koha-community.org 10 Mar '26

10 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20817 Bug ID: 20817 Summary: Acquisitions development - Ordering existing items Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: kyle(a)bywatersolutions.com Reporter: kyle(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org Acquisitions: attaching orders to existing records while retaining 9xx information. -- You are receiving this mail because: You are watching all bug changes.

1 162