July 2026 - Koha-bugs - lists.koha-community.org

[Bug 42253] Stored XSS in advanced editor in Macro name
by bugzilla-daemon＠bugs.koha-community.org 02 Jul '26

02 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42253 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|26.05.00,25.11.04,25.05.10, |26.05.00,25.11.04,25.05.10, released in|24.11.15,22.11.37 |24.11.15 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42253] Stored XSS in advanced editor in Macro name
by bugzilla-daemon＠bugs.koha-community.org 02 Jul '26

02 Jul '26

1 0

[Bug 42978] New: Renewal window
by bugzilla-daemon＠bugs.koha-community.org 02 Jul '26

02 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42978 Bug ID: 42978 Summary: Renewal window Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: cbrannon(a)cdalibrary.org QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle(a)bywatersolutions.com Target Milestone: --- Should renewals have a window of time (both manual and auto) for renewals, in order to prevent checkout abuse. Consider, you have ManualRenewalPeriodBase set to "the old duedate of the checkout". You check it out, and the patron or staff at some point before it is due hits renewal (either on accident or on purpose). For this scenario, lets say it is done right after checkout. This could effectively work around limits to not renew if the item goes on hold. If the library allows a couple of renewals, this prevents bringing the item back sooner if others are waiting for the item. I haven't seen such a window, but allowing a window of x number of days before and after the due date to renew would make sense, to limit people gaming the checkout period. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 1

[Bug 42917] New: Error when changing existing hold from item/record level with only place_holds permission
by bugzilla-daemon＠bugs.koha-community.org 02 Jul '26

02 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42917 Bug ID: 42917 Summary: Error when changing existing hold from item/record level with only place_holds permission Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Hold requests Assignee: koha-bugs(a)lists.koha-community.org Reporter: lucas(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, lisette(a)bywatersolutions.com, tomascohen(a)gmail.com Target Milestone: --- To recreate: 1/ Create or find a user with place_hold permission but not the top level permission 2/ Place a hold 3/ From reserve/request.pl?biblionumber=X try to change the hold from record to item, or vice versa. 4/ See popup: There was an error:error Forbidden -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 3

[Bug 42960] New: Database update 25.12.00.059 attempts Elasticsearch mapping update when SearchEngine is Zebra
by bugzilla-daemon＠bugs.koha-community.org 02 Jul '26

02 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42960 Bug ID: 42960 Summary: Database update 25.12.00.059 attempts Elasticsearch mapping update when SearchEngine is Zebra Initiative type: --- Sponsorship --- status: Product: Koha Version: 26.05 Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Installation and upgrade (command-line installer) Assignee: koha-bugs(a)lists.koha-community.org Reporter: mark(a)hofstetter.at QA Contact: testopia(a)bugs.koha-community.org CC: tomascohen(a)gmail.com Target Milestone: --- When upgrading a Koha instance to 26.05, db revision 25.12.00.059 (Bug 40658 - Ensure local-number is sortable) unconditionally instantiates Koha::SearchEngine::Elasticsearch::Indexer and calls update_mappings(). This happens even when the instance has SearchEngine = Zebra. On a Zebra-only instance without Elasticsearch configured, koha-upgrade-schema fails and blocks the entire schema upgrade: Upgrade to 25.12.00.059: Bug 40658 - Ensure local-number is sortable ERROR: Exception 'Koha::Exception' thrown 'Unable to update mappings for index "koha_lise_biblios". Reason was: "". Index needs to be recreated and reindexed' Reproduced in koha-testing-docker with KOHA_IMAGE=26.05, SearchEngine=Zebra, by resetting Version to 25.1200058 and setting local-number sort=0. Expected behavior: - The DB revision should still set search_marc_to_field.sort = 1. - Elasticsearch mappings should only be updated if SearchEngine is Elasticsearch. - Zebra-only instances should not require Elasticsearch to complete koha-upgrade-schema. Proposed fix: Guard the Elasticsearch mapping update with: if ( C4::Context->preference('SearchEngine') eq 'Elasticsearch' ) { ... } and report that the ES mapping update was skipped otherwise. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 3

[Bug 9598] Ability to split up shipping cost between all items and funds on an invoice
by bugzilla-daemon＠bugs.koha-community.org 02 Jul '26

02 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9598 Bethany <badubois(a)huntington.edu> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |badubois(a)huntington.edu --- Comment #5 from Bethany <badubois(a)huntington.edu> --- This would be a very nice addition. It would also be nice to add the option to add processing fees per item and not as a total amount. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0

[Bug 37463] New: Include cover images on staff interface check out screen
by bugzilla-daemon＠bugs.koha-community.org 02 Jul '26

02 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37463 Bug ID: 37463 Summary: Include cover images on staff interface check out screen Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: danyonsewell(a)catalyst.net.nz QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com We would like to request an enhancement for cover images to be visible on the check out/issues screen a the time of issuing books. We would like this option to be enabled for specific borrower categories, eg we would enable for student and staff categories, but not for general borrower categories such as Library trollies. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 43

[Bug 40582] New: Serials subscription not linked to an acquisitions basket
by bugzilla-daemon＠bugs.koha-community.org 02 Jul '26

02 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40582 Bug ID: 40582 Summary: Serials subscription not linked to an acquisitions basket Change sponsored?: --- Product: Koha Version: 24.11 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Acquisitions Assignee: koha-bugs(a)lists.koha-community.org Reporter: angela.berrett(a)familysearch.org QA Contact: testopia(a)bugs.koha-community.org We use a vendor to manage and maintain many of our serial subscriptions. We have this vendor in the Acquisitions module and create baskets for putting in invoices. However, there is no way to tie the individual serial issues to the monthly or quarterly baskets, so when we receive and issue it doesn't clear from the basket as received. We have to manually go into the basket and marked it as received as well as processing it in the Serials module. Can the serials subscription be linked to a basket? -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 3

[Bug 13985] [Omnibus] Cash Management - Koha as 'Point of Sale'
by bugzilla-daemon＠bugs.koha-community.org 02 Jul '26

02 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13985 Martin Renvoize (ashimema) <martin.renvoize(a)openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |33501 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33501 [Bug 33501] Add optional support for different payment types during cashup reconciliation -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42966] New: Migrate POS payment screen to Vue.js (pos/pay.pl)
by bugzilla-daemon＠bugs.koha-community.org 02 Jul '26

02 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42966 Bug ID: 42966 Summary: Migrate POS payment screen to Vue.js (pos/pay.pl) Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Point of Sale Assignee: koha-bugs(a)lists.koha-community.org Reporter: martin.renvoize(a)openfifth.co.uk QA Contact: martin.renvoize(a)openfifth.co.uk Depends on: 42962, 42964, 42965 Blocks: 42959 Target Milestone: --- This is part of the Point of Sale to Vue migration tracked under bug 42959. This patch replaces pos/pay.pl and pos/pay.tt with a Vue.js 3 application, following the module/route/store/component pattern already established by the ERM and Preservation modules under koha-tmpl/intranet-tmpl/prog/js/vue/. This bug covers both the initial application scaffold (module entry point, route definitions, Pinia store, API composables) and the payment screen itself, since a bare scaffold with no visible UI is not meaningfully testable on its own. Scope: - Register selector - Sellable debit types table (item selection), backed by bug 42964 - Running sale total / cart - Payment collection form (tendered amount, change calculation, payment type), backed by bug 42965 - Email receipt action - Removal of the legacy pos/pay.pl controller and pos/pay.tt template once parity is confirmed, including the cash_management: takepayment permission check moving to the API layer - Cypress coverage for the sale flow, included as part of this patchset This is a rework, not a strict like-for-like port: minor UX improvements to the flow are welcome as long as all existing end-user actions remain possible. Larger UX ideas that surface during the work but are out of scope here should be captured as follow-on bugs rather than expanding this one. If gaps or reusable improvements in the shared Vue component library are identified while building this (e.g. a generic money/currency input, item-picker component, or form validation helper), split those out as separate prerequisite bugs so they can land independently and be reused by other Vue modules. Test plan: 1. Enable EnablePointOfSale and UseCashRegisters. 2. Navigate to the new Vue-based POS payment screen and select a register. 3. Add one or more sellable items to the sale and confirm the running total updates correctly. 4. Take payment, confirm change calculation, and confirm the resulting accountlines match what the legacy pos/pay.pl produced. 5. Email a receipt and confirm delivery. 6. Confirm the cash_management: takepayment permission is enforced. 7. Run the included Cypress spec. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42959 [Bug 42959] Migrate staff interface functionality from CGI controller + Template Toolkit to REST API + Vue.js https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42962 [Bug 42962] Expose cash register outstanding accountlines via REST API https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42964 [Bug 42964] Expose sellable debit types scoped by library via REST API https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42965 [Bug 42965] REST API: Endpoint to record an anonymous or patron-optional POS sale -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 1