June 2026 - Koha-bugs - lists.koha-community.org

[Bug 42845] New: Access to ILL requires parameters => 'manage_sysprefs'
by bugzilla-daemon＠bugs.koha-community.org 15 Jun '26

15 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42845 Bug ID: 42845 Summary: Access to ILL requires parameters => 'manage_sysprefs' Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: ILL Assignee: koha-bugs(a)lists.koha-community.org Reporter: nugged(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org CC: lisette(a)bywatersolutions.com, pedro.amorim(a)openfifth.co.uk, tomascohen(a)gmail.com Depends on: 37762 Target Milestone: --- The ILL Vue app reads `ILLModule` and `ILLPartnerCode` through the system preferences service when it starts. That service requires `parameters/manage_sysprefs`, so a staff user with ILL permissions but without system preference administration permissions cannot load the ILL module. Steps to reproduce: 1. Enable `ILLModule`. 2. Set `ILLPartnerCode` to an existing patron category used for ILL partners. 3. Create a staff user with ILL permissions, but without `parameters/manage_sysprefs`. 4. Log in with that staff user. 5. Go to the staff ILL module at `/cgi-bin/koha/ill/ill.pl`. Expected result: The ILL module loads for a staff user with ILL permissions. Actual result: The ILL module cannot load its runtime configuration because the system preferences service returns an authorization failure. Depending on the UI path, the user may see an error such as `Something went wrong when loading the table. 401: Unauthorized`, followed by JavaScript errors caused by missing configuration data. Technical note: This is the same class of issue as bug 33606 for ERM. The proposed patch adds a module-specific `/ill/config` endpoint protected by the `ill` permission. It returns only allow-listed, non-secret ILL configuration values needed by the ILL Vue app. It does not expose the generic system preferences API, and `/api/v1/sysprefs` remains restricted to `parameters/manage_sysprefs`. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37762 [Bug 37762] Expand ILL to allow for supplying agency/lending library workflows -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 4

[Bug 33606] New: Access to ERM requires parameters => 'manage_sysprefs'
by bugzilla-daemon＠bugs.koha-community.org 15 Jun '26

15 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33606 Bug ID: 33606 Summary: Access to ERM requires parameters => 'manage_sysprefs' Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: ERM Assignee: jonathan.druart+koha(a)gmail.com Reporter: jonathan.druart+koha(a)gmail.com CC: jonathan.druart+koha(a)gmail.com, jonathan.field(a)ptfs-europe.com, martin.renvoize(a)ptfs-europe.com, matt.blenkinsop(a)ptfs-europe.com, pedro.amorim(a)ptfs-europe.com Since bug 33408 we are fetching sysprefs from svc/config/systempreferences, but this script requires parameters => 'manage_sysprefs' -- You are receiving this mail because: You are watching all bug changes.

1 71

[Bug 42361] [CVE-2026-6428] SQL Injection in reports/catalogue_out.pl via Filter parameter (error-based, triggered when Criteria matches /branchcode/)
by bugzilla-daemon＠bugs.koha-community.org 15 Jun '26

15 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42361 --- Comment #30 from Sanjarbiy <sanjarbiy11(a)gmail.com> --- Thanks David, that means a lot. It has been a pleasure working with you and Jonathan, and I am glad the CVE record turned out well. Looking forward to continuing. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42361] [CVE-2026-6428] SQL Injection in reports/catalogue_out.pl via Filter parameter (error-based, triggered when Criteria matches /branchcode/)
by bugzilla-daemon＠bugs.koha-community.org 15 Jun '26

15 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42361 --- Comment #29 from David Cook <dcook(a)prosentient.com.au> --- (In reply to Sanjarbiy from comment #27) > CVE-2026-6428 has been assigned and published for this issue via > TuranSecurity (a CVE Numbering Authority). Public record: > https://www.cve.org/CVERecord?id=CVE-2026-6428 . Thanks to David and > Jonathan for the fix and review. I also meant to say good job on the CVE entry. I'm glad to see that it has a reference back here and covers the affected versions. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42361] [CVE-2026-6428] SQL Injection in reports/catalogue_out.pl via Filter parameter (error-based, triggered when Criteria matches /branchcode/)
by bugzilla-daemon＠bugs.koha-community.org 15 Jun '26

15 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42361 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|SQL Injection in |[CVE-2026-6428] SQL |reports/catalogue_out.pl |Injection in |via Filter parameter |reports/catalogue_out.pl |(error-based, triggered |via Filter parameter |when Criteria matches |(error-based, triggered |/branchcode/) |when Criteria matches | |/branchcode/) --- Comment #28 from David Cook <dcook(a)prosentient.com.au> --- (In reply to Sanjarbiy from comment #27) > CVE-2026-6428 has been assigned and published for this issue via > TuranSecurity (a CVE Numbering Authority). Public record: > https://www.cve.org/CVERecord?id=CVE-2026-6428 . Thanks to David and > Jonathan for the fix and review. Thanks, Sanjar, for reporting the issue and respecting our process. I recognise the name Turan Security. We've had other reports from employees/former employees from there. Very happy to keep working with you on the issues you report. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 32791] New: Log4perl configuration files need a tool for updating on package upgrade
by bugzilla-daemon＠bugs.koha-community.org 15 Jun '26

15 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32791 Bug ID: 32791 Summary: Log4perl configuration files need a tool for updating on package upgrade Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: dcook(a)prosentient.com.au QA Contact: testopia(a)bugs.koha-community.org Typically, we update existing log4perl.conf files using debian/koha-common.postinst but it's making that file grow way too much and it's difficult to test. Instead, let's provide a CLI tool that we can more easily test and update without touching debian/koha-common.postinst directly. It should hopefully simplify maintenance. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 25

[Bug 42577] New: Gettext.js incorrectly located and tidied
by bugzilla-daemon＠bugs.koha-community.org 15 Jun '26

15 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42577 Bug ID: 42577 Summary: Gettext.js incorrectly located and tidied Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: trivial Priority: P5 - low Component: Templates Assignee: oleonard(a)myacpl.org Reporter: dcook(a)prosentient.com.au QA Contact: testopia(a)bugs.koha-community.org If you look at opac-tmpl/bootstrap/js/Gettext.js or its intranet-tmpl equivalent, you'll notice that it's actually a third-party script and not a Koha script, so it should be in the "lib" folder and the license for it should be added to about.tt We've also tidied the file because it wasn't in "lib"... so we might want to undo that. -- You are receiving this mail because: You are watching all bug changes.

1 4

[Bug 32489] New: Add check out date, number of renewals, numbers of overdue days in list of overdues
by bugzilla-daemon＠bugs.koha-community.org 14 Jun '26

14 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32489 Bug ID: 32489 Summary: Add check out date, number of renewals, numbers of overdue days in list of overdues Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: mathsabypro(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com In circ/overdue.pl it could be useful to add for each line - the check out date - the number of renewals - the number of overdue days (today - due date) -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 5

[Bug 14587] Acq: Make it possible to edit asort1 and asort2 values on receive
by bugzilla-daemon＠bugs.koha-community.org 14 Jun '26

14 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14587 --- Comment #3 from Mathieu Saby <mathsabypro(a)gmail.com> --- Oh yes! But the label of the link could be edited to be more explicit. It is "edit fund". Maybe it could be "edit fund or statistical codes" ? Same remark for the title of the popup ("Update received fund") -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 10198] Add the ability to import and export authorized values
by bugzilla-daemon＠bugs.koha-community.org 14 Jun '26

14 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10198 --- Comment #9 from Mathieu Saby <mathsabypro(a)gmail.com> --- Thank you for this proposal! This seems to address the core of the requirement, but each value code can be linked to a description, an OPAC description, an icon, and branch restrictions. Are you suggesting that we manage only the descriptions, or also the icons and branch restrictions? -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0