March 2026 - Koha-bugs - lists.koha-community.org

[Bug 38818] New: Add diag option to t::lib::Mocks::Logger
by bugzilla-daemon＠bugs.koha-community.org 05 Mar '26

05 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38818 Bug ID: 38818 Summary: Add diag option to t::lib::Mocks::Logger Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Test Suite Assignee: chris(a)bigballofwax.co.nz Reporter: martin.renvoize(a)ptfs-europe.com QA Contact: testopia(a)bugs.koha-community.org The logger testing module is handy, but having a diag option to output all log lines currently sitting in the logger object would be helpful. This would aid in later debugging. -- You are receiving this mail because: You are watching all bug changes.

1 20

[Bug 41644] New: Store datetime for reserves.cancellationdate
by bugzilla-daemon＠bugs.koha-community.org 05 Mar '26

05 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41644 Bug ID: 41644 Summary: Store datetime for reserves.cancellationdate Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Hold requests Assignee: koha-bugs(a)lists.koha-community.org Reporter: aleisha(a)catalyst.net.nz QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, lisette(a)bywatersolutions.com, tomascohen(a)gmail.com It would be helpful to know what time a hold was cancelled, not just the date. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 2

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 05 Mar '26

05 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #264 from David Cook <dcook(a)prosentient.com.au> --- I think that might be all points addressed now? -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 05 Mar '26

05 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Failed QA -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 05 Mar '26

05 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 05 Mar '26

05 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #263 from David Cook <dcook(a)prosentient.com.au> --- Test plan: 0. Apply the patch 1. cp debian/templates/plack.psgi /etc/koha/sites/kohadev/plack.psgi 2. Add conf to /etc/koha/sites/kohadev/koha-conf.xml <content_security_policy> <opac> <csp_mode>report-only</csp_mode> <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'; report-uri /api/v1/public/csp-reports; report-to csp-violations</csp_header_value> </opac> <intranet> <csp_mode>report-only</csp_mode> <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'; report-uri /api/v1/public/csp-reports; report-to csp-violations</csp_header_value> </intranet> </content_security_policy> 3. Rebuild resources perl build-resources.PL 4. Add the following to /etc/koha/sites/kohadev/log4perl.conf log4perl.logger.csp = WARN, CSP log4perl.appender.CSP=Log::Log4perl::Appender::File log4perl.appender.CSP.filename=/var/log/koha/kohadev/csp-violations.log log4perl.appender.CSP.mode=append log4perl.appender.CSP.layout=PatternLayout log4perl.appender.CSP.layout.ConversionPattern=[%d] %m%n log4perl.appender.CSP.utf8=1 log4perl.logger.plack-csp = WARN, PLACKCSP log4perl.appender.PLACKCSP=Log::Log4perl::Appender::File log4perl.appender.PLACKCSP.filename=/var/log/koha/kohadev/plack-csp-violations.log log4perl.appender.PLACKCSP.mode=append log4perl.appender.PLACKCSP.layout=PatternLayout log4perl.appender.PLACKCSP.layout.ConversionPattern=[%d] %m%n log4perl.appender.PLACKCSP.utf8=1 5. Restart everything restart_all 6. Run unit tests: GIT_INSTALL=1 KOHA_HOME=/kohadevbox/koha/ prove -v t/Koha/ContentSecurityPolicy.t t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t t/db_dependent/Koha/Template/Plugin/Koha.t t/db_dependent/api/v1/public/csp_reports.t 7. Set up SSL on OPAC - sudo vi /etc/apache2/sites-enabled/kohadev.conf Add the following to the bottom of the OPAC :8080 virtualhost: SSLEngine on SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key - sudo a2enmod ssl - sudo service apache2 restart 8. Manual testing Open your F12 dev tools, go to the Console tab, and look for CSP errors as you navigate around Koha. - Go to /cgi-bin/koha/tools/additional-contents.pl?op=add_form&category=news&editmode=wysiwyg in the staff interface - Add a news item for "Staff interface and OPAC" with the following HTML: <script>console.log('boo')</script> - To test the OPAC with CSP violation reports, go to https://kohadev.mydnsname.org:8080/ - If you're not seeing reports in /var/log/koha/kohadev/plack-csp-violations.log, try using a different browser or a private/incognito window NOTE: The following is an example of Firefox and Chrome reporting (respectively) [2026/03/04 03:18:20] CSP violation: 'script-src-elem' blocked 'inline' on page 'https://kohadev.mydnsname.org:8080/' at https://kohadev.mydnsname.org:8080/:763:63 [2026/03/04 03:18:26] CSP violation: 'script-src-elem' blocked 'inline' on page 'https://kohadev.mydnsname.org:8080/' at https://kohadev.mydnsname.org:8080/:763 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 05 Mar '26

05 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #262 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 194479 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=194479&action=e… Bug 38365: Set __webpack_nonce__ for style-loader plugin and fix fontawesome imports By setting __webpack_nonce__ webpack/rspack will add the nonce to styles added using style-loader plugin. Also, stop fontawesome from auto injecting CSS elements, and instead manually import them so that they can be picked up by style-loader -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 05 Mar '26

05 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #261 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 194478 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=194478&action=e… Bug 38365: Make tidy.pl compatible with script elements with attributes tidy.pl will still tidy whitespace around script elements that have attributes like "nonce" -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 05 Mar '26

05 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #260 from David Cook <dcook(a)prosentient.com.au> --- Created attachment 194477 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=194477&action=e… Bug 38365: Fix t/db_dependent/Koha/Plugins/Valuebuilder_hooks.t This initialises the CSP nonce in the unit test so that t/lib/plugins/Koha/Plugin/TestValuebuilder/test_valuebuilder_popup.tt will get its script element rewritten correctly. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 05 Mar '26

05 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 --- Comment #259 from David Cook <dcook(a)prosentient.com.au> --- I think I've worked out a workaround for style-loader, but there's still an issue with how the font awesome styles are imported (without style-loader it seems). Ah yeah... in node_modules/(a)fortawesome/fontawesome-svg-core/index.js it does the following: DOCUMENT.head.insertBefore(style, beforeChild); Think we'd have to turn off the auto injecting of style using config.autoAddCss for fontawesome-svg-core and import fontawesome CSS explicitly. This seems to do the trick. I'll do a patch for that too... -- You are receiving this mail because: You are watching all bug changes.

1 0