August 2026 - Koha-bugs - lists.koha-community.org

[Bug 43235] New: Update some serials pages to use grid layout for forms - Part 2
by bugzilla-daemon＠bugs.koha-community.org 10 Aug '26

10 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43235 Bug ID: 43235 Summary: Update some serials pages to use grid layout for forms - Part 2 Initiative type: --- Sponsorship Sponsored status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Templates Assignee: oleonard(a)myacpl.org Reporter: oleonard(a)myacpl.org QA Contact: testopia(a)bugs.koha-community.org CC: testopia(a)bugs.koha-community.org Depends on: 39780 Target Milestone: --- - serials/subscription-batchedit.tt - serials/subscription-frequencies.tt - serials/subscription-numberpatterns.tt Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39780 [Bug 39780] Update library groups form to use grid layout -- You are receiving this mail because: You are watching all bug changes.

1 2

[Bug 43264] New: Update some circulation pages to use grid layout for forms
by bugzilla-daemon＠bugs.koha-community.org 10 Aug '26

10 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43264 Bug ID: 43264 Summary: Update some circulation pages to use grid layout for forms Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Templates Assignee: oleonard(a)myacpl.org Reporter: oleonard(a)myacpl.org QA Contact: testopia(a)bugs.koha-community.org Depends on: 39780 Target Milestone: --- - circ/request-article.tt - circ/set-library.tt Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39780 [Bug 39780] Update library groups form to use grid layout -- You are receiving this mail because: You are watching all bug changes.

1 2

[Bug 41017] New: Show if item is on hold even if OverduesBlockRenewing is on
by bugzilla-daemon＠bugs.koha-community.org 10 Aug '26

10 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41017 Bug ID: 41017 Summary: Show if item is on hold even if OverduesBlockRenewing is on Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: caroline.cyr-la-rose(a)inlibro.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle(a)bywatersolutions.com I've had a comment by a library that uses OverduesBlockRenewing as well as AllowRenewalLimitOverride (and AllowRenewalOnHoldOverride) that when the item is overdue, the fact that it's on hold is not displayed in the patron's checkouts. Their issue is that while they don't want patrons renewing overdue items from the OPAC, they sometimes override the renewal in the staff interface, but end up unknowingly renewing something that is on hold... To recreate in main: 1. Go to a patron's account and checkout with a past date to create an overdue checkout 2. Place a hold for the same item for another patron 3. View the first patron's checkouts --> In the "Renew" column, it says "On hold" 4. Enable AllowRenewalOnHoldOverride 5. Go back to the patron's checkouts --> The "Renew" column should still say "On hold" 6. Check the "Override renewal restrictions" box --> A check box appears in the "Renew" column, which still displays "On hold" nonetheless 7. Enable OverduesBlockRenewing ("block renewing for all the patron's items") (I think both blocks should work in this scenario, but the library has it set to all) 8. Enable AllowRenewalLimitOverride 9. Go back to the patron's checkouts --> The "Renew" column displays "Not allowed: overdue" (OK) No mention of on hold (NOT OK?) 10. Check the "Override renewal restrictions" box --> A check box appears in the "Renew" column (OK), still no mention of on hold (NOT OK?) The "On hold" mention should be displayed whether or not the item is overdue. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 39

[Bug 43263] New: Public biblio ratings API does not check OpacSuppression
by bugzilla-daemon＠bugs.koha-community.org 10 Aug '26

10 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43263 Bug ID: 43263 Summary: Public biblio ratings API does not check OpacSuppression Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: tomascohen(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Depends on: 43258 Target Milestone: --- POST /api/v1/public/biblios/:id/ratings (Koha::REST::V1::Biblios::set_rating) does not check whether the biblio is suppressed. A logged-in patron can rate a suppressed record if they know its biblio_id, confirming the existence of a record that should be hidden. Impact: information disclosure - the existence of suppressed bibliographic records can be confirmed via the public API (a successful rating confirms the record exists). Affected endpoints: - POST /api/v1/public/biblios/:id/ratings (Koha::REST::V1::Biblios::set_rating) Related: bug 43258 introduces Koha::IP and Koha::REST::Plugin::Restrictions which provide the fix mechanism. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43258 [Bug 43258] Add a centralized IP range matching helper -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0

[Bug 43262] New: Public biblio items API does not check OpacSuppression
by bugzilla-daemon＠bugs.koha-community.org 10 Aug '26

10 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43262 Bug ID: 43262 Summary: Public biblio items API does not check OpacSuppression Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: tomascohen(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Depends on: 43258 Target Milestone: --- GET /api/v1/public/biblios/:id/items (Koha::REST::V1::Biblios::get_items_public) does not check whether the parent biblio is suppressed. If a client knows the biblio_id of a suppressed record, they can enumerate its items via the public API. The endpoint uses filter_by_visible_in_opac() which handles OpacHiddenItems at the item level, but does not check biblio-level suppression (OpacSuppression / OpacSuppressionByIPRange). Impact: information disclosure - items belonging to suppressed bibliographic records are accessible via the public API. Affected endpoints: - GET /api/v1/public/biblios/:id/items (Koha::REST::V1::Biblios::get_items_public) Related: bug 43258 introduces Koha::IP and Koha::REST::Plugin::Restrictions which provide the fix mechanism. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43258 [Bug 43258] Add a centralized IP range matching helper -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0

[Bug 8214] Create a bound with function
by bugzilla-daemon＠bugs.koha-community.org 10 Aug '26

10 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8214 Adriana Delgado <adelgado(a)dma.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |adelgado(a)dma.org -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 41614] New: additional_contents REST endpoint broke the display location filter
by bugzilla-daemon＠bugs.koha-community.org 10 Aug '26

10 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41614 Bug ID: 41614 Summary: additional_contents REST endpoint broke the display location filter Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: REST API Assignee: koha-bugs(a)lists.koha-community.org Reporter: oleonard(a)myacpl.org QA Contact: testopia(a)bugs.koha-community.org CC: pedro.amorim(a)openfifth.co.uk, tomascohen(a)gmail.com Depends on: 39900 Following the addition of Bug 39900 the "display location" filter in the sidebar of the HTML customizations page is empty. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39900 [Bug 39900] Add public REST endpoint for additional_contents -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 19

[Bug 42053] New: Bug 37893 DBUpdate does not always add the new userflags/permissions
by bugzilla-daemon＠bugs.koha-community.org 10 Aug '26

10 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42053 Bug ID: 42053 Summary: Bug 37893 DBUpdate does not always add the new userflags/permissions Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: SIP2 Assignee: koha-bugs(a)lists.koha-community.org Reporter: lucas(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org In db_revs/250600035.pl for the SIP2 module there is: unless ( -f $SIPconfigFile && -r $SIPconfigFile ) { say_warning( $out, "Skipping migration. SIP config file not found or unreadable" ); return; } and then later: $dbh->do( q{INSERT IGNORE INTO userflags (bit, flag, flagdesc, defaulton) VALUES (31, 'sip2', 'Manage SIP2 module', 0) } ); So the permissions are only added if there is a SIP config. The permissions should be added no matter what. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 27

[Bug 41261] XSS vulnerability in opac/unAPI
by bugzilla-daemon＠bugs.koha-community.org 10 Aug '26

10 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41261 Caroline Cyr La Rose <caroline.cyr-la-rose(a)inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs documenting |RESOLVED Resolution|--- |FIXED --- Comment #23 from Caroline Cyr La Rose <caroline.cyr-la-rose(a)inlibro.com> --- Bug fix. Nothing to add or edit in the Koha manual. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42369] [CVE-2026-70372] SQL Injection in reports/bor_issues_top.pl via the Filter request parameter (unvalidated string context, no placeholders)
by bugzilla-daemon＠bugs.koha-community.org 10 Aug '26

10 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42369 Caroline Cyr La Rose <caroline.cyr-la-rose(a)inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Needs documenting |RESOLVED --- Comment #12 from Caroline Cyr La Rose <caroline.cyr-la-rose(a)inlibro.com> --- Bug fix. Nothing to add or edit in the Koha manual. -- You are receiving this mail because: You are watching all bug changes.

1 0