July 2026 - Koha-bugs - lists.koha-community.org

[Bug 42735] SQL Injection in reports/issues_stats.pl via PeriodTypeSel / PeriodDaySel / PeriodMonthSel / Filter parameters (unvalidated string context, no placeholders)
by bugzilla-daemon＠bugs.koha-community.org 17 Jul '26

17 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42735 Fridolin Somers <fridolin.somers(a)biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Needs documenting -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42369] SQL Injection in reports/bor_issues_top.pl via the Filter request parameter (unvalidated string context, no placeholders)
by bugzilla-daemon＠bugs.koha-community.org 17 Jul '26

17 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42369 Fridolin Somers <fridolin.somers(a)biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Needs documenting -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42368] SQL Injection in reports/issues_avg_stats.pl via the Filter request parameter (unvalidated string context, no placeholders)
by bugzilla-daemon＠bugs.koha-community.org 17 Jul '26

17 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42368 Fridolin Somers <fridolin.somers(a)biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Needs documenting -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42363] SQL Injection in reports/catalogue_stats.pl via the Line request parameter
by bugzilla-daemon＠bugs.koha-community.org 17 Jul '26

17 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42363 Fridolin Somers <fridolin.somers(a)biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Needs documenting -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42360] SQL Injection in reports/acquisitions_stats.pl via Filter parameter
by bugzilla-daemon＠bugs.koha-community.org 17 Jul '26

17 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42360 Fridolin Somers <fridolin.somers(a)biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Needs documenting -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42360] SQL Injection in reports/acquisitions_stats.pl via Filter parameter
by bugzilla-daemon＠bugs.koha-community.org 17 Jul '26

17 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42360 Fridolin Somers <fridolin.somers(a)biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Pushed to stable -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42277] New: JS error when viewing a subscription
by bugzilla-daemon＠bugs.koha-community.org 17 Jul '26

17 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42277 Bug ID: 42277 Summary: JS error when viewing a subscription Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Serials Assignee: koha-bugs(a)lists.koha-community.org Reporter: jonathan.druart(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org If no orders exist yet, there is a JS error in the console: Uncaught TypeError: can't access property "DataTable", table is undefined -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 23

[Bug 41337] New: koha-create --request-db and --populate-db creates log files owned by root (intranet-error.log, opac-error.log)
by bugzilla-daemon＠bugs.koha-community.org 17 Jul '26

17 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41337 Bug ID: 41337 Summary: koha-create --request-db and --populate-db creates log files owned by root (intranet-error.log, opac-error.log) Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: Linux Status: NEW Severity: major Priority: P5 - low Component: Installation and upgrade (command-line installer) Assignee: koha-bugs(a)lists.koha-community.org Reporter: saiful(a)semanticconsulting.com QA Contact: testopia(a)bugs.koha-community.org CC: tomascohen(a)gmail.com When creating a new Koha instance using the two-step workflow (--request-db and --populate-db), some log files under /var/log/koha/<instance>/ end up with incorrect permissions. Specifically, intranet-error.log and opac-error.log are created as root:root instead of <inst>-koha:<inst>-koha. This causes Apache/Plack to fail to start cleanly until the ownership is corrected manually. Steps to Reproduce: 1. Run: koha-create --request-db test 2. Create the DB/user on the remote or local DB host as instructed. 3. Then run: koha-create --populate-db test 4. Check ownership of generated logs: ls -l /var/log/koha/test Actual Result: Two files are owned by root:root: -rw-r--r-- 1 root root 0 intranet-error.log -rw-r--r-- 1 root root 0 opac-error.log All other logs have correct ownership (test-koha:test-koha). Koha will not start smoothly until these two files are manually chowned. Expected Result: All log files under /var/log/koha/<instance>/ should be owned by <instance>-koha:<instance>-koha, identical to a normal koha-create run without the request/populate split. Notes: This only happens when using the two-step creation (--request-db + --populate-db). A normal one-step koha-create with --create-db assigns the correct ownership. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 21

[Bug 41690] New: Add MARC21 245$b (subtitle) to Cite option
by bugzilla-daemon＠bugs.koha-community.org 17 Jul '26

17 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41690 Bug ID: 41690 Summary: Add MARC21 245$b (subtitle) to Cite option Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: caroline.cyr-la-rose(a)inlibro.com QA Contact: testopia(a)bugs.koha-community.org The "Cite" option in the OPAC is missing the subtitle (245$b) in MARC21. To recreate: 1. Add a record or find a record with a subtitle (in KTD, biblionumber 58 has a 245$b http://localhost:8081/cgi-bin/koha/catalogue/MARCdetail.pl?biblionumber=58 2. In the OPAC, go to the record http://localhost:8080/cgi-bin/koha/opac-detail.pl?biblionumber=58 3. Click "Cite" --> The subtitle is not in any of the citations I consulted a customer in a university and he said the subtitle should be after the title and be preceded by a colon. e.g. 'More fruitful than the soil' : army, empire and the Scottish Highlands, 1715-1815 -- You are receiving this mail because: You are watching all bug changes.

1 30

[Bug 42262] New: MARC 006 tag editor plugin drops blank value in position 17 when editing existing tag
by bugzilla-daemon＠bugs.koha-community.org 17 Jul '26

17 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42262 Bug ID: 42262 Summary: MARC 006 tag editor plugin drops blank value in position 17 when editing existing tag Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Cataloging Assignee: koha-bugs(a)lists.koha-community.org Reporter: andrew(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: m.de.rooy(a)rijksmuseum.nl When one opens the 006 tag editor plugin when editing a record that already has an 006 value, a blank value in position 17 is dropped by the plugin. This causes the record to save an invalid 006, triggering the error message added in Bug 40272. To recreate: - have a MARC record with Type of Material "BKS - Books" that does not have an 006 defined (biblio 1 in the KTD default data will work) - edit the biblio in the basic editor - open the tag editor for the 006 - observe that the values along the top of the tag editor window show a value of "" (blank) in position 17 - click Save in the tag editor window - confirm that the values in the 006 tag end with a space - open the 006 tag editor again - observe that the values along the top of the tag editor window no longer show any value for position 17. Instead, they end with the zero in position 16 - click Save in the tag editor window - confirm that the values in the 006 tag now end with a zero, not followed by a space - save your biblio - edit the biblio in the basic editor again, get warning "The following fixed-length control field(s) have an invalid length: 006. Please fix." -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 21