June 2026 - Koha-bugs - lists.koha-community.org

[Bug 38338] New: Add support for XOAUTH2 authentication for SMTP servers
by bugzilla-daemon＠bugs.koha-community.org 09 Jul '26

09 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38338 Bug ID: 38338 Summary: Add support for XOAUTH2 authentication for SMTP servers Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: dcook(a)prosentient.com.au QA Contact: testopia(a)bugs.koha-community.org Both Google and Microsoft have been pushing XOAUTH2 for SMTP AUTH over the traditional basic username/password authentication for some time now and we haven't really had a good answer for Koha admins. For SMTP connections in Koha, we use Email::Sender::Transport::SMTP::Persistent which uses Authen::SASL which uses libsasl2 (if available) or a pure Perl fallback. Out of the box, neither libsasl2 nor Authen::SASL::Perl provides XOAUTH2 support. However, there are a number of SASL plugins out there. I'll explain more in the comments. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 116

[Bug 42870] New: Add plugin hook for email transports
by bugzilla-daemon＠bugs.koha-community.org 09 Jul '26

09 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42870 Bug ID: 42870 Summary: Add plugin hook for email transports Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: dcook(a)prosentient.com.au QA Contact: testopia(a)bugs.koha-community.org Target Milestone: --- I'm proposing to add a plugin hook for email transports (e.g. email_transport), so that Koha::SMTP::Server can use a transport supplied by a Koha Plugin rather than Email::Sender::Transport::SMTP::Persistent in Koha::SMTP::Server::transport(). This would enable us to quickly add options for newer SMTP authentication methods (see bug 38338 regarding SMTP XOAUTH2) or to use APIs for sending emails (see bug 42179 for using Microsoft Graph API for sending email). -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 23

[Bug 42547] New: SIP performance is terrible if sip2_resource_last_modified is missing from memcached
by bugzilla-daemon＠bugs.koha-community.org 09 Jul '26

09 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42547 Bug ID: 42547 Summary: SIP performance is terrible if sip2_resource_last_modified is missing from memcached Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: SIP2 Assignee: koha-bugs(a)lists.koha-community.org Reporter: kyle(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org In Koha, the sip2_resource_last_modified key is updated any time the SIP config is edited from the SIP2 editor in the staff interface ( institutions, accounts, system preference overrides ). If sip2_resource_last_modified is missing from memcached, Koha SIP emits "Couldn't find sip2_resource_last_modified, considering configuration not up to date" in the logs, and fetches the entire configuration from the database, *for each request*. This causes SIP performance to drop significantly. In my production testing with 83 institutions and 171 accounts the login message response time dropped from 0.283 seconds to 2.899 seconds. I think the solution is pretty simple. If there is a cache miss on sip2_resource_last_modified, SIP should load the config from database as it does already, but then it should also set sip2_resource_last_modified! -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 18

[Bug 34755] New: Error authenticating to external OpenID Connect (OIDC) identity provider : wrong_csrf_token
by bugzilla-daemon＠bugs.koha-community.org 09 Jul '26

09 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34755 Bug ID: 34755 Summary: Error authenticating to external OpenID Connect (OIDC) identity provider : wrong_csrf_token Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: critical Priority: P5 - low Component: Authentication Assignee: koha-bugs(a)lists.koha-community.org Reporter: michaela.sieber(a)kit.edu QA Contact: testopia(a)bugs.koha-community.org CC: dpavlin(a)rot13.org Since update to koha 23.05 we have an issue with OpenID Connect Authentication. When using OIDC authentication we often (but not always) get the error message "There was an error authenticating to external identity provider wrong_csrf_token" in OPAC or staff. If the user clicks once again on the login button he is logged in his opac account. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 68

[Bug 37741] New: Koha errors on page (e.g. 404) cause incorrect CSRF errors
by bugzilla-daemon＠bugs.koha-community.org 09 Jul '26

09 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37741 Bug ID: 37741 Summary: Koha errors on page (e.g. 404) cause incorrect CSRF errors Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: critical Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: dcook(a)prosentient.com.au QA Contact: testopia(a)bugs.koha-community.org To reproduce: 1. Set syspref IntranetFavicon to http://localhost:8081/cgi-bin/koha/bad.jpg 2. Open browser developer tools 3. Go to http://localhost:8081/cgi-bin/koha/mainpage.pl 4. Open the Network tab, disable the cache, and shift refresh 5. Notice that bad.jpg fails to load with a 404 6. Try to login to Koha 7. Confirm 403 error 8. If you look at the cookies sent/received by mainpage.pl on the first load, the bad.jpg load, and the second mainpage.pl load, you'll see that first mainpage.pl returns a cookie, which is used by bad.jpg, which returns a new cookie, which is used by the second mainpage.pl However, the CSRF token submitted with the second mainpage.pl is tied to the cookie from the first mainpage.pl load! It'll never work! The solution is to stop 404.pl from returning a 404.pl cookie. After all, 404.pl shouldn't be creating/updating a cookie. It's just supposed to return a pretty 404 document. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 21

[Bug 36934] New: "Wrong CSRF" after login rejection (StaffLoginRestrictBranchByIP)
by bugzilla-daemon＠bugs.koha-community.org 09 Jul '26

09 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36934 Bug ID: 36934 Summary: "Wrong CSRF" after login rejection (StaffLoginRestrictBranchByIP) Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Staff interface Assignee: koha-bugs(a)lists.koha-community.org Reporter: jonathan.druart(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Depends on: 36933 Found when testing StaffLoginRestrictBranchByIP: * Turn on StaffLoginRestrictBranchByIP * Set CPL's IP to 1.2.3.4 * Go to the staff login screen and try to connect to CPL => Error: Autolocation is switched on and you are logging in with an IP address that doesn't match your library. (OK) * Pick another library => 403 (KO) -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 8

[Bug 39739] New: OPAC's datatables.js out of sync with staff's
by bugzilla-daemon＠bugs.koha-community.org 09 Jul '26

09 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39739 Bug ID: 39739 Summary: OPAC's datatables.js out of sync with staff's Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Templates Assignee: oleonard(a)myacpl.org Reporter: tomascohen(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org When helping adapt bug 38340 to our coding guidelines and general style, I found the need to rewrite a manually crafted datatable using kohaTable. What I found is that key pieces (like x-koha-request-id handling) are missing. I propose we port the intranet version into the OPAC. With some caveats. -- You are receiving this mail because: You are watching all bug changes.

1 33

[Bug 41285] New: ERM: Agreements are missing space before and after options
by bugzilla-daemon＠bugs.koha-community.org 08 Jul '26

08 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41285 Bug ID: 41285 Summary: ERM: Agreements are missing space before and after options Initiative type: --- Sponsorship --- status: Product: Koha Version: 24.11 Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Templates Assignee: oleonard(a)myacpl.org Reporter: katrin.fischer(a)bsz-bw.de QA Contact: testopia(a)bugs.koha-community.org Created attachment 189894 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=189894&action=e… screenshot of table with agreement When looking at the list of agrements, there is a filter on top of the table. This filter section is missing some whitespace around and before options, as shown in the screenshot. -- You are receiving this mail because: You are watching all bug changes.

1 10

[Bug 41971] New: Library-specific Pages for OPAC openly accessible
by bugzilla-daemon＠bugs.koha-community.org 08 Jul '26

08 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41971 Bug ID: 41971 Summary: Library-specific Pages for OPAC openly accessible Initiative type: --- Sponsorship --- status: Product: Koha Version: 24.11 Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Tools Assignee: koha-bugs(a)lists.koha-community.org Reporter: david_liddle(a)sil.org QA Contact: testopia(a)bugs.koha-community.org After an upgrade of test and production instances from Koha 22.11 to Koha 24.11, we discovered that Pages (Tools > Additional tools) with library-specific (branch-specific) settings were openly accessible. That is, not only could they be viewed by patrons of other libraries, they could be viewed publicly (without authentication). To reproduce: 1. Create a new page. - Display location = OPAC - Library = specific, but different from the current user (for certainty) - Publication date = Yesterday or Today - Title and Content = minimally necessary content 2. Save the new page. 3. Right-click the OPAC link and copy the link address. 4. Open a Guest profile window, which has no association with any existing session. 5. Paste the link and go to the address. 6. The library-specific page will be loaded without prompting for authentication. (If using a sandbox, ensure that OPACBaseURL is set correctly.) -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 1

[Bug 29720] New: Allow per-user customization of table settings
by bugzilla-daemon＠bugs.koha-community.org 08 Jul '26

08 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29720 Bug ID: 29720 Summary: Allow per-user customization of table settings Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Staff Client Assignee: koha-bugs(a)lists.koha-community.org Reporter: andrew(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Table settings are currently global. Per-user customization would be great! -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 4