July 2026 - Koha-bugs - lists.koha-community.org

[Bug 21860] New: Marc modification templates cannot check or change indicators
by bugzilla-daemon＠bugs.koha-community.org 13 Jul '26

13 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21860 Bug ID: 21860 Summary: Marc modification templates cannot check or change indicators Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Tools Assignee: koha-bugs(a)lists.koha-community.org Reporter: pasi.kallinen(a)joensuu.fi QA Contact: testopia(a)bugs.koha-community.org The marc modification templates have no way of checking or changing indicator values. This seems like a pretty big oversight. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 69

[Bug 43055] New: HTML customizations adds a white background
by bugzilla-daemon＠bugs.koha-community.org 13 Jul '26

13 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43055 Bug ID: 43055 Summary: HTML customizations adds a white background Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Tools Assignee: koha-bugs(a)lists.koha-community.org Reporter: cbrannon(a)cdalibrary.org QA Contact: testopia(a)bugs.koha-community.org Target Milestone: --- HTML customizations includes a white background which is not always wanted. Is this intentional, or can it be shut off? It would be easy to add to content if needed, but is more difficult to remove if it isn't needed. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 4

[Bug 42948] New: Diacritics corrupted when saving authority records (UTF-8 mangled into unrelated Unicode characters, e.g. é→ř, ú/ñ→ž)
by bugzilla-daemon＠bugs.koha-community.org 13 Jul '26

13 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42948 Bug ID: 42948 Summary: Diacritics corrupted when saving authority records (UTF-8 mangled into unrelated Unicode characters, e.g. é→ř, ú/ñ→ž) Initiative type: --- Sponsorship --- status: Product: Koha Version: 26.05 Hardware: PC OS: Linux Status: NEW Severity: major Priority: P5 - low Component: MARC Authority data support Assignee: koha-bugs(a)lists.koha-community.org Reporter: 328807(a)unizar.es QA Contact: testopia(a)bugs.koha-community.org Target Milestone: --- Created attachment 201329 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=201329&action=e… Attachments included: 1 Screenshot of authority before save (correct name) 2 Screenshot of authority after save (corrupted name) 3 Screenshot showing the same corruption when typed When creating or saving an authority record containing accented characters (e.g. Spanish names with á, é, í, ó, ú, ñ), the diacritics are corrupted into unrelated Unicode characters upon save. The corruption pattern is not simple mojibake (e.g. "Ã©") but rather diacritics merging with adjacent letters into different Unicode characters, including letters from other alphabets (e.g. ř, ž, ø, æ). Example: Correct name: "Pérez Zúñiga, Juan" After saving the authority in Koha: "Přez Žiga, Juan" Correct name: "García-Posada, Miguel" After saving: "Garcá-Posada, Miguel" (character dropped entirely) Steps to reproduce: Go to Authorities module. Create a new authority manually (New authority), entering a personal name with accented characters directly in field 100 $a (e.g. "Hierro, José" or "Pérez Zúñiga, Juan"). Save the record. Reopen the saved authority record. Observe that the accented characters have been replaced/corrupted. This reproduces even when the authority is created entirely manually, without using Z39.50/SRU import, ruling out any Z39.50 target encoding issue. Troubleshooting already performed (ruling out other causes): Confirmed the issue is NOT related to the Z39.50/BNE server encoding: tested with UTF-8, MARC-8, ISO-5426, ISO-8859-1 and ISO_6937 encodings on the Z39.50 target — all produce different (but still wrong) corruption patterns, and the corruption also occurs when manually typing the authority without using Z39.50 at all. Confirmed the Leader position 09 (Character coding scheme) of the bibliographic record is correctly set to "a" (UCS/Unicode), auto-filled. Confirmed the same corruption occurs when importing the same correct UTF-8 data from a different Z39.50 target (Library of Congress Names), which displays the name correctly in the search results list, but the data is still corrupted once saved as a Koha authority — pointing to the save process itself, not the data source. Confirmed database-level encoding is correctly configured throughout: Database: utf8mb4 / utf8mb4_uca1400_ai_ci Table auth_header: column marcxml is longtext with collation utf8mb4_unicode_ci MySQL/MariaDB session variables (character_set_client, character_set_connection, character_set_database, character_set_results, character_set_server) all set to utf8mb4 collation_connection, collation_database, collation_server all utf8mb4_uca1400_ai_ci Given the above, the corruption appears to originate in the Koha application layer (Perl/Plack) during the authority save process, rather than in any Z39.50 target configuration or in the database encoding configuration. Environment: Koha version: 26.05.00 Database: MariaDB (utf8mb4, collation utf8mb4_uca1400_ai_ci) Authority framework: MARC21 PERSO_NAME Attachments included: • Screenshot of authority before save (correct name) • Screenshot of authority after save (corrupted name) • Screenshot showing the same corruption when typed manually (no Z39.50 involved) -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 13

[Bug 42369] SQL Injection in reports/bor_issues_top.pl via the Filter request parameter (unvalidated string context, no placeholders)
by bugzilla-daemon＠bugs.koha-community.org 13 Jul '26

13 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42369 Pedro Amorim (ammopt) <pedro.amorim(a)openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)|26.05.01,25.11.06,25.05.12, |26.11.00,26.05.01,25.11.06, released in|24.11.17 |25.05.12,24.11.17 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42368] SQL Injection in reports/issues_avg_stats.pl via the Filter request parameter (unvalidated string context, no placeholders)
by bugzilla-daemon＠bugs.koha-community.org 13 Jul '26

13 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42368 --- Comment #19 from Pedro Amorim (ammopt) <pedro.amorim(a)openfifth.co.uk> --- Thanks everyone! Pushed to main for 26.11! -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42368] SQL Injection in reports/issues_avg_stats.pl via the Filter request parameter (unvalidated string context, no placeholders)
by bugzilla-daemon＠bugs.koha-community.org 13 Jul '26

13 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42368 Pedro Amorim (ammopt) <pedro.amorim(a)openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)|26.05.01,25.11.06,25.05.12, |26.11.00,26.05.01,25.11.06, released in|24.11.17 |25.05.12,24.11.17 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42363] SQL Injection in reports/catalogue_stats.pl via the Line request parameter
by bugzilla-daemon＠bugs.koha-community.org 13 Jul '26

13 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42363 --- Comment #10 from Pedro Amorim (ammopt) <pedro.amorim(a)openfifth.co.uk> --- Thanks everyone! Pushed to main for 26.11! -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42363] SQL Injection in reports/catalogue_stats.pl via the Line request parameter
by bugzilla-daemon＠bugs.koha-community.org 13 Jul '26

13 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42363 Pedro Amorim (ammopt) <pedro.amorim(a)openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|26.05.01,25.11.06,25.05.12, |26.11.00,26.05.01,25.11.06, released in|24.11.17 |25.05.12,24.11.17 Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42360] SQL Injection in reports/acquisitions_stats.pl via Filter parameter
by bugzilla-daemon＠bugs.koha-community.org 13 Jul '26

13 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42360 --- Comment #36 from Pedro Amorim (ammopt) <pedro.amorim(a)openfifth.co.uk> --- Thanks everyone! Pushed to main for 26.11! -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42360] SQL Injection in reports/acquisitions_stats.pl via Filter parameter
by bugzilla-daemon＠bugs.koha-community.org 13 Jul '26

13 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42360 Pedro Amorim (ammopt) <pedro.amorim(a)openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|26.05.01,25.11.06,25.05.12, |26.11.00,26.05.01,25.11.06, released in|24.11.17 |25.05.12,24.11.17 Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.

1 0