July 2026 - Koha-bugs - lists.koha-community.org

[Bug 42252] Stored XSS when deleting a list or removing a list share
by bugzilla-daemon＠bugs.koha-community.org 02 Jul '26

02 Jul '26

1 0

[Bug 42254] DOM XSS via tag search
by bugzilla-daemon＠bugs.koha-community.org 02 Jul '26

02 Jul '26

1 0

[Bug 42253] Stored XSS in advanced editor in Macro name
by bugzilla-daemon＠bugs.koha-community.org 02 Jul '26

02 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42253 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Needs documenting -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42253] Stored XSS in advanced editor in Macro name
by bugzilla-daemon＠bugs.koha-community.org 02 Jul '26

02 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42253 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|26.05.00,25.11.04,25.05.10, |26.05.00,25.11.04,25.05.10, released in|24.11.15 |24.11.15,22.11.37 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42253] Stored XSS in advanced editor in Macro name
by bugzilla-daemon＠bugs.koha-community.org 02 Jul '26

02 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42253 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|26.05.00,25.11.04,25.05.10, |26.05.00,25.11.04,25.05.10, released in|24.11.15,22.11.37 |24.11.15 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42253] Stored XSS in advanced editor in Macro name
by bugzilla-daemon＠bugs.koha-community.org 02 Jul '26

02 Jul '26

1 0

[Bug 41674] New: Add template plugin for linking to system preferences based on user permission
by bugzilla-daemon＠bugs.koha-community.org 01 Jul '26

01 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41674 Bug ID: 41674 Summary: Add template plugin for linking to system preferences based on user permission Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: oleonard(a)myacpl.org Reporter: oleonard(a)myacpl.org QA Contact: testopia(a)bugs.koha-community.org There are many places in templates where we link to a system preference and we are inconsistent about whether these links are dependent on the permission of the logged-in user. I propose to add a template plugin which handles the permission check. [% "RequireChoosingExistingAuthority" | html | $LinkPref %] For a user with 'CAN_user_parameters_manage_sysprefs' permission it outputs: <a class="link_preference" href="admin/preferences.pl?op=search&ok=Search&searchfield=RequireChoosingExistingAuthority">RequireChoosingExistingAuthority</a> For a user without permission it outputs: <span class="link_preference">RequireChoosingExistingAuthority</span> -- You are receiving this mail because: You are watching all bug changes.

1 21

[Bug 42978] New: Renewal window
by bugzilla-daemon＠bugs.koha-community.org 01 Jul '26

01 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42978 Bug ID: 42978 Summary: Renewal window Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: cbrannon(a)cdalibrary.org QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle(a)bywatersolutions.com Target Milestone: --- Should renewals have a window of time (both manual and auto) for renewals, in order to prevent checkout abuse. Consider, you have ManualRenewalPeriodBase set to "the old duedate of the checkout". You check it out, and the patron or staff at some point before it is due hits renewal (either on accident or on purpose). For this scenario, lets say it is done right after checkout. This could effectively work around limits to not renew if the item goes on hold. If the library allows a couple of renewals, this prevents bringing the item back sooner if others are waiting for the item. I haven't seen such a window, but allowing a window of x number of days before and after the due date to renew would make sense, to limit people gaming the checkout period. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 1

[Bug 42917] New: Error when changing existing hold from item/record level with only place_holds permission
by bugzilla-daemon＠bugs.koha-community.org 01 Jul '26

01 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42917 Bug ID: 42917 Summary: Error when changing existing hold from item/record level with only place_holds permission Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Hold requests Assignee: koha-bugs(a)lists.koha-community.org Reporter: lucas(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, lisette(a)bywatersolutions.com, tomascohen(a)gmail.com Target Milestone: --- To recreate: 1/ Create or find a user with place_hold permission but not the top level permission 2/ Place a hold 3/ From reserve/request.pl?biblionumber=X try to change the hold from record to item, or vice versa. 4/ See popup: There was an error:error Forbidden -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 3

[Bug 39027] New: News are order with older on top
by bugzilla-daemon＠bugs.koha-community.org 01 Jul '26

01 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39027 Bug ID: 39027 Summary: News are order with older on top Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: marion.durand(a)biblibre.com QA Contact: testopia(a)bugs.koha-community.org When a news is created, it is displayed last in the news list at the OPAC. You can change that behaviors by using the field 'Number' to order them manually but then, you have to manually edit all news to add a new one first. -- You are receiving this mail because: You are watching all bug changes.

1 35