August 2026 - Koha-bugs - lists.koha-community.org

[Bug 41614] New: additional_contents REST endpoint broke the display location filter
by bugzilla-daemon＠bugs.koha-community.org 10 Aug '26

10 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41614 Bug ID: 41614 Summary: additional_contents REST endpoint broke the display location filter Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: REST API Assignee: koha-bugs(a)lists.koha-community.org Reporter: oleonard(a)myacpl.org QA Contact: testopia(a)bugs.koha-community.org CC: pedro.amorim(a)openfifth.co.uk, tomascohen(a)gmail.com Depends on: 39900 Following the addition of Bug 39900 the "display location" filter in the sidebar of the HTML customizations page is empty. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39900 [Bug 39900] Add public REST endpoint for additional_contents -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 19

[Bug 42053] New: Bug 37893 DBUpdate does not always add the new userflags/permissions
by bugzilla-daemon＠bugs.koha-community.org 10 Aug '26

10 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42053 Bug ID: 42053 Summary: Bug 37893 DBUpdate does not always add the new userflags/permissions Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: SIP2 Assignee: koha-bugs(a)lists.koha-community.org Reporter: lucas(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org In db_revs/250600035.pl for the SIP2 module there is: unless ( -f $SIPconfigFile && -r $SIPconfigFile ) { say_warning( $out, "Skipping migration. SIP config file not found or unreadable" ); return; } and then later: $dbh->do( q{INSERT IGNORE INTO userflags (bit, flag, flagdesc, defaulton) VALUES (31, 'sip2', 'Manage SIP2 module', 0) } ); So the permissions are only added if there is a SIP config. The permissions should be added no matter what. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 27

[Bug 41261] XSS vulnerability in opac/unAPI
by bugzilla-daemon＠bugs.koha-community.org 10 Aug '26

10 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41261 Caroline Cyr La Rose <caroline.cyr-la-rose(a)inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs documenting |RESOLVED Resolution|--- |FIXED --- Comment #23 from Caroline Cyr La Rose <caroline.cyr-la-rose(a)inlibro.com> --- Bug fix. Nothing to add or edit in the Koha manual. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42369] [CVE-2026-70372] SQL Injection in reports/bor_issues_top.pl via the Filter request parameter (unvalidated string context, no placeholders)
by bugzilla-daemon＠bugs.koha-community.org 10 Aug '26

10 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42369 Caroline Cyr La Rose <caroline.cyr-la-rose(a)inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Needs documenting |RESOLVED --- Comment #12 from Caroline Cyr La Rose <caroline.cyr-la-rose(a)inlibro.com> --- Bug fix. Nothing to add or edit in the Koha manual. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42368] [CVE-2026-70371] SQL Injection in reports/issues_avg_stats.pl via the Filter request parameter (unvalidated string context, no placeholders)
by bugzilla-daemon＠bugs.koha-community.org 10 Aug '26

10 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42368 Caroline Cyr La Rose <caroline.cyr-la-rose(a)inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs documenting |RESOLVED Resolution|--- |FIXED --- Comment #21 from Caroline Cyr La Rose <caroline.cyr-la-rose(a)inlibro.com> --- Bug fix. Nothing to add or edit in the Koha manual. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 41662] CSRF-vulnerability in opac-patron-consent.pl.
by bugzilla-daemon＠bugs.koha-community.org 10 Aug '26

10 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41662 Caroline Cyr La Rose <caroline.cyr-la-rose(a)inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs documenting |RESOLVED Resolution|--- |FIXED --- Comment #19 from Caroline Cyr La Rose <caroline.cyr-la-rose(a)inlibro.com> --- Bug fix. Nothing to add or edit in the Koha manual. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42363] [CVE-2026-70370] SQL Injection in reports/catalogue_stats.pl via the Line request parameter
by bugzilla-daemon＠bugs.koha-community.org 10 Aug '26

10 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42363 Caroline Cyr La Rose <caroline.cyr-la-rose(a)inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Needs documenting |RESOLVED --- Comment #12 from Caroline Cyr La Rose <caroline.cyr-la-rose(a)inlibro.com> --- Bug fix. Nothing to add or edit in the Koha manual. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 41438] New: Batch hold tool: Suspended holds are unsuspended when making other changes to holds
by bugzilla-daemon＠bugs.koha-community.org 10 Aug '26

10 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41438 Bug ID: 41438 Summary: Batch hold tool: Suspended holds are unsuspended when making other changes to holds Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Tools Assignee: koha-bugs(a)lists.koha-community.org Reporter: emmi.takkinen(a)koha-suomi.fi QA Contact: testopia(a)bugs.koha-community.org If one modifies suspended holds e.g. changes their pickup library, holds are unsuspended. This happens due error in logic of checking if "Suspend holds" selection is empty. To reproduce: 1. Navigate to Tools->Batch modify holds. 2. Search suspended holds. 3. Select a hold to modify and change it's pickup library, but leave "Suspend holds" selection empty. 4. Press "Modify holds". => Note that hold is now not suspended. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 30

[Bug 41798] New: Cannot enable 'passive' mode in File Transports for FTP
by bugzilla-daemon＠bugs.koha-community.org 10 Aug '26

10 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41798 Bug ID: 41798 Summary: Cannot enable 'passive' mode in File Transports for FTP Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: critical Priority: P5 - low Component: Staff interface Assignee: koha-bugs(a)lists.koha-community.org Reporter: martin.renvoize(a)openfifth.co.uk QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com At some point in the (S)FTP transports bugs, we missed a patch that updated the controller to recognise 'passive' vs 'passiv' (i.e. the spelling fix) This causes issues when trying to enable the passive mode which is recommended for FTP endpoints. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 19

[Bug 41781] New: Holds queue builder ( build_holds_queue.pl ) fails if HoldsQueueParallelLoopsCount is greater than 1
by bugzilla-daemon＠bugs.koha-community.org 10 Aug '26

10 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41781 Bug ID: 41781 Summary: Holds queue builder ( build_holds_queue.pl ) fails if HoldsQueueParallelLoopsCount is greater than 1 Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: critical Priority: P5 - low Component: Hold requests Assignee: koha-bugs(a)lists.koha-community.org Reporter: kyle(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, lisette(a)bywatersolutions.com, tomascohen(a)gmail.com If HoldsQueueParallelLoopsCount is set to a value greater than 1, build_holds_queue.pl will fail with the message: Can't locate object method "new" via package "Parallel::ForkManager" (perhaps you forgot to load "Parallel::ForkManager"?) at /kohadevbox/koha/C4/HoldsQueue.pm line 205. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 22