April 2026 - Koha-bugs - lists.koha-community.org

[Bug 19852] New: Add message text box in circulation for patrons does not accept HTML tags
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=19852 Bug ID: 19852 Summary: Add message text box in circulation for patrons does not accept HTML tags Change sponsored?: --- Product: Koha Version: 17.05 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Staff Client Assignee: koha-bugs(a)lists.koha-community.org Reporter: michael(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Created attachment 69958 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=69958&action=ed… result after adding HTML tags for a patron message Hi When you add a patron message in circulation.pl, the modal that appears has a text box that does not accept HTML tags. Some libraries use HTML tags in these messages to link to information in Koha and to format the display of the message (see attached). Having this modal accept HTML would allow formatting and linking in messages. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 13

[Bug 23978] New: notes field in saved reports should allow HTML
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23978 Bug ID: 23978 Summary: notes field in saved reports should allow HTML Change sponsored?: --- Product: Koha Version: 18.11 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Reports Assignee: koha-bugs(a)lists.koha-community.org Reporter: theod(a)lib.auth.gr QA Contact: testopia(a)bugs.koha-community.org In recent Koha 18.11, parsing of HTML tags was removed from many fields for security reasons. However, as also seen in 22938, 22702, 22501, 23194, 23683 there are places where HTML (or at leas line breaks!) are required, or the output is too messy. The 'notes' field in the "Guided reports wizard › Saved reports" displays the data that is previously entered in a textarea. However, the guided_reports_start.tt does not parse the HTML (nor line breaks), so the output in the resulting table is all in one line! As with the other patches, I propose that we allow HTML in report notes, so one can use strong/italics/colors/urls in notes, and most importantly, line breaks! -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 48

[Bug 41529] New: HTML code visible in the table listing saved reports
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41529 Bug ID: 41529 Summary: HTML code visible in the table listing saved reports Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Reports Assignee: koha-bugs(a)lists.koha-community.org Reporter: raymund.delahunty(a)outlook.com QA Contact: testopia(a)bugs.koha-community.org CC: lisette(a)bywatersolutions.com Created attachment 190917 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=190917&action=e… With and without JQuery, in 25.11 >From 25.11 Bug 23978 allows for HTML to be added to the Notes field in reports but the HTML tags appear in the reports list view, making identification of the desired report (and understanding what the report identifies) harder. This was not the case in 24:11 (for example) where using the code listed in the JQuery Library (‘Render patron messages as HTML and in Report notes’) saw the Notes column rendered with the HTML applied, not with HTML code showing. Adding this code to IntranetUserJS in 25.11 sees the Notes field in the list view rendered correctly without the HTML code visible. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 3

[Bug 41547] New: Create a template tool to give libraries control over on screen messages and modals
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41547 Bug ID: 41547 Summary: Create a template tool to give libraries control over on screen messages and modals Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: george(a)nekls.org QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle(a)bywatersolutions.com Bug 41539 adds item barcode content to the "Holds waiting" message on #circ_circulation and #pat_moremember. It occurs to me that it would be nice if the content of this message could be controlled using a template through the HTML customizations tool or through the notice and slips templates. That would allow libraries to decide what content to have in that message without a developer having to write a patch for Koha every time someone wants to add or remove content in that message. It seems that this idea could be also applied to other messages in Koha. It would be nice to give more control over the content of messages and modals to individual libraries rather than forcing all Koha users into a one-size-fits all system. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 12

[Bug 35291] [CVE-2023-44962] File Upload vulnerability in upload-cover-image.pl
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35291 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs(a)lists.koha-commun |dcook(a)prosentient.com.au |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0

[Bug 36818] [CVE-2024-36057] Remote-Code-Execution (RCE) in upload-cover-image.pl
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36818 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs(a)lists.koha-commun |chris(a)bigballofwax.co.nz |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0

[Bug 38470] [CVE-2024-12915] Subscription detail page vulnerable to reflected XSS
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38470 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Subscription detail page |[CVE-2024-12915] |vulnerable to reflected XSS |Subscription detail page | |vulnerable to reflected XSS -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38961] [CVE-2024-12915] XSS in vendor search
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38961 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|XSS in vendor search |[CVE-2024-12915] XSS in | |vendor search -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 38469] [CVE-2024-12915] Circulation returns vulnerable to reflected XSS
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38469 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Circulation returns |[CVE-2024-12915] |vulnerable to reflected XSS |Circulation returns | |vulnerable to reflected XSS -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 23093] New: Error during upgrade of OpacNavRight preference to Koha news
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23093 Bug ID: 23093 Summary: Error during upgrade of OpacNavRight preference to Koha news Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Tools Assignee: koha-bugs(a)lists.koha-community.org Reporter: oleonard(a)myacpl.org QA Contact: testopia(a)bugs.koha-community.org CC: testopia(a)bugs.koha-community.org Depends on: 22318 Target Milestone: --- Copied from Bug 22318: Moving the contents of OpacNavRight to opac_news fails due to improper (no?) escaping: DBD::mysql::db do failed: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'http':'https';if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src=p+' at line 1 [for Statement "INSERT INTO opac_news (branchcode, lang, title, content ) VALUES (NULL, 'OpacNavRight_en', '', ' <a class="twitter-timeline" href="https://twitter.com/ETFLibrary" data-widget-id="702160486524186624">Tweets by @ETFLibrary</a> <script>!function(d,s,id){var js,fjs=d.getElementsByTagName(s)[0],p=/^http:/.test(d.location)?'http':'https';if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src=p+"://platform.twitter.com/widgets.js";fjs.parentNode.insertBefore(js,fjs);}}(document,"script","twitter-wjs");</script> ')"] at /usr/share/koha/intranet/cgi-bin/installer/data/mysql/updatedatabase.pl line 18220. In this example, OpacNavRight contains a script to embed a Twitter timeline. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22318 [Bug 22318] Extend Koha news feature to include other content areas -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 14