July 2026 - Koha-bugs - lists.koha-community.org

[Bug 37741] New: Koha errors on page (e.g. 404) cause incorrect CSRF errors
by bugzilla-daemon＠bugs.koha-community.org 09 Jul '26

09 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37741 Bug ID: 37741 Summary: Koha errors on page (e.g. 404) cause incorrect CSRF errors Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: critical Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: dcook(a)prosentient.com.au QA Contact: testopia(a)bugs.koha-community.org To reproduce: 1. Set syspref IntranetFavicon to http://localhost:8081/cgi-bin/koha/bad.jpg 2. Open browser developer tools 3. Go to http://localhost:8081/cgi-bin/koha/mainpage.pl 4. Open the Network tab, disable the cache, and shift refresh 5. Notice that bad.jpg fails to load with a 404 6. Try to login to Koha 7. Confirm 403 error 8. If you look at the cookies sent/received by mainpage.pl on the first load, the bad.jpg load, and the second mainpage.pl load, you'll see that first mainpage.pl returns a cookie, which is used by bad.jpg, which returns a new cookie, which is used by the second mainpage.pl However, the CSRF token submitted with the second mainpage.pl is tied to the cookie from the first mainpage.pl load! It'll never work! The solution is to stop 404.pl from returning a 404.pl cookie. After all, 404.pl shouldn't be creating/updating a cookie. It's just supposed to return a pretty 404 document. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 21

[Bug 36934] New: "Wrong CSRF" after login rejection (StaffLoginRestrictBranchByIP)
by bugzilla-daemon＠bugs.koha-community.org 09 Jul '26

09 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36934 Bug ID: 36934 Summary: "Wrong CSRF" after login rejection (StaffLoginRestrictBranchByIP) Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Staff interface Assignee: koha-bugs(a)lists.koha-community.org Reporter: jonathan.druart(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Depends on: 36933 Found when testing StaffLoginRestrictBranchByIP: * Turn on StaffLoginRestrictBranchByIP * Set CPL's IP to 1.2.3.4 * Go to the staff login screen and try to connect to CPL => Error: Autolocation is switched on and you are logging in with an IP address that doesn't match your library. (OK) * Pick another library => 403 (KO) -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 8

[Bug 39739] New: OPAC's datatables.js out of sync with staff's
by bugzilla-daemon＠bugs.koha-community.org 09 Jul '26

09 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39739 Bug ID: 39739 Summary: OPAC's datatables.js out of sync with staff's Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Templates Assignee: oleonard(a)myacpl.org Reporter: tomascohen(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org When helping adapt bug 38340 to our coding guidelines and general style, I found the need to rewrite a manually crafted datatable using kohaTable. What I found is that key pieces (like x-koha-request-id handling) are missing. I propose we port the intranet version into the OPAC. With some caveats. -- You are receiving this mail because: You are watching all bug changes.

1 33

[Bug 41285] New: ERM: Agreements are missing space before and after options
by bugzilla-daemon＠bugs.koha-community.org 08 Jul '26

08 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41285 Bug ID: 41285 Summary: ERM: Agreements are missing space before and after options Initiative type: --- Sponsorship --- status: Product: Koha Version: 24.11 Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Templates Assignee: oleonard(a)myacpl.org Reporter: katrin.fischer(a)bsz-bw.de QA Contact: testopia(a)bugs.koha-community.org Created attachment 189894 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=189894&action=e… screenshot of table with agreement When looking at the list of agrements, there is a filter on top of the table. This filter section is missing some whitespace around and before options, as shown in the screenshot. -- You are receiving this mail because: You are watching all bug changes.

1 10

[Bug 43021] New: A single malformed Z39.50/SRU result can break search and staged record preview
by bugzilla-daemon＠bugs.koha-community.org 08 Jul '26

08 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43021 Bug ID: 43021 Summary: A single malformed Z39.50/SRU result can break search and staged record preview Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Z39.50 / SRU / OpenSearch Servers Assignee: koha-bugs(a)lists.koha-community.org Reporter: martin.renvoize(a)openfifth.co.uk QA Contact: testopia(a)bugs.koha-community.org CC: m.de.rooy(a)rijksmuseum.nl Depends on: 35104 Target Milestone: --- Two related, unguarded MARC decode calls in the Z39.50/SRU search and staged record ("breeding") preview flow: 1. C4::Breeding::_handle_one_result (C4/Breeding.pm) calls MARC::Record->new_from_xml on each SRU search result with no eval. The caller loop that iterates search results across all configured servers already has per-result error handling for other kinds of failures (connection diagnostics collected in @errconn), but this call bypasses it entirely - one malformed record from any searched server aborts the whole results page for the cataloguer running the search. 2. MARCfindbreeding in cataloguing/addbiblio.pl calls MARC::Record->new_from_usmarc on a staged ("breeding") record with no eval, when a cataloguer opens that staged record to preview/import it. Both should catch a decode failure for the one affected record and report it to the user (e.g. skip that result with a visible message, or show a clear error instead of a blank/broken page) rather than propagating an uncaught exception. Found while auditing other places in the codebase that ingest externally-sourced MARC data, prompted by bug 35104. Test plan: 1. Configure a Z39.50/SRU target and search it for records, where at least one result server returns a record whose MARC cannot be decoded (or simulate by mocking C4::Breeding::_handle_one_result's input). 2. Before a fix: the whole results page fails/errors out. 3. Separately, stage a file containing an undecodable record via Stage MARC records for import, then open it via the cataloguing "breeding" preview. 4. Before a fix: the preview page errors out. 5. After a fix: both cases show a clear per-record error and let the user continue working with the rest of the results/batch. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35104 [Bug 35104] We should warn when attempting to save MARC records that contain characters invalid in XML -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 2

[Bug 41971] New: Library-specific Pages for OPAC openly accessible
by bugzilla-daemon＠bugs.koha-community.org 08 Jul '26

08 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41971 Bug ID: 41971 Summary: Library-specific Pages for OPAC openly accessible Initiative type: --- Sponsorship --- status: Product: Koha Version: 24.11 Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Tools Assignee: koha-bugs(a)lists.koha-community.org Reporter: david_liddle(a)sil.org QA Contact: testopia(a)bugs.koha-community.org After an upgrade of test and production instances from Koha 22.11 to Koha 24.11, we discovered that Pages (Tools > Additional tools) with library-specific (branch-specific) settings were openly accessible. That is, not only could they be viewed by patrons of other libraries, they could be viewed publicly (without authentication). To reproduce: 1. Create a new page. - Display location = OPAC - Library = specific, but different from the current user (for certainty) - Publication date = Yesterday or Today - Title and Content = minimally necessary content 2. Save the new page. 3. Right-click the OPAC link and copy the link address. 4. Open a Guest profile window, which has no association with any existing session. 5. Paste the link and go to the address. 6. The library-specific page will be loaded without prompting for authentication. (If using a sandbox, ensure that OPACBaseURL is set correctly.) -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 1

[Bug 29720] New: Allow per-user customization of table settings
by bugzilla-daemon＠bugs.koha-community.org 08 Jul '26

08 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29720 Bug ID: 29720 Summary: Allow per-user customization of table settings Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Staff Client Assignee: koha-bugs(a)lists.koha-community.org Reporter: andrew(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Table settings are currently global. Per-user customization would be great! -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 4

[Bug 29281] New: Allow per-user configuration of table settings and default sort orders
by bugzilla-daemon＠bugs.koha-community.org 08 Jul '26

08 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29281 Bug ID: 29281 Summary: Allow per-user configuration of table settings and default sort orders Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Staff Client Assignee: koha-bugs(a)lists.koha-community.org Reporter: andrew(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Different users will have different needs for what's shown in any given table in the staff interface. Table settings only allow things to be shown/hidden systemwide. It'd be great to have a way for individual users to pick their own defaults. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 3

[Bug 42301] New: updatedatabase fails on mysql when adding a unique key to a text column (introduced by 35380)
by bugzilla-daemon＠bugs.koha-community.org 08 Jul '26

08 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42301 Bug ID: 42301 Summary: updatedatabase fails on mysql when adding a unique key to a text column (introduced by 35380) Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Installation and upgrade (command-line installer) Assignee: koha-bugs(a)lists.koha-community.org Reporter: bibliothek(a)th-wildau.de QA Contact: testopia(a)bugs.koha-community.org CC: tomascohen(a)gmail.com The column 'name' is altered to be unique in bug 38530 When using mariadb this works fine but when using mysql as db engine this error is thrown; ERROR: {UNKNOWN}: DBI Exception: DBD::mysql::db do failed: BLOB/TEXT column 'name' used in key specification without a key length at /kohadevbox/koha/C4/Installer.pm line 818 to recreate: - run ktd with mysql f.e.: DB_IMAGE=mysql:8.0 ktd --proxy --name mysql8 up -d - enter ktd shell ktd --name mysql8 --shell - checkout a Koha version prior to 35380 - reset_all - checkout main - updatedatabase -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 18

[Bug 42975] New: Patron category filters broken in Record overlay rules
by bugzilla-daemon＠bugs.koha-community.org 08 Jul '26

08 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42975 Bug ID: 42975 Summary: Patron category filters broken in Record overlay rules Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Cataloging Assignee: koha-bugs(a)lists.koha-community.org Reporter: ephetteplace(a)cca.edu QA Contact: testopia(a)bugs.koha-community.org CC: m.de.rooy(a)rijksmuseum.nl Target Milestone: --- On main, if you turn on MARCOverlayRules and go to Admin > Record overlay rules the rules are broken for Module = Patron category. If you select Patron category, the "filter" dropdown menu lists 14 entries of "[object Object]". Some piece of patron data is unsuccessfully being cast to a string in the page's JavaScript. We are on 25.11 so our overlay rules are broken in a different way, but I think this should list several patron category properties. I'm guessing this originates right at the top of the JS <script> at the bottom of koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc-overlay-rules.tt: var categories = [% To.json( categories ) | $raw %]; -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 12