August 2026 - Koha-bugs - lists.koha-community.org

[Bug 40658] New: When sorting by local-number we should use the sort field
by bugzilla-daemon＠bugs.koha-community.org 05 Aug '26

05 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40658 Bug ID: 40658 Summary: When sorting by local-number we should use the sort field Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Searching - Elasticsearch Assignee: koha-bugs(a)lists.koha-community.org Reporter: nick(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org When adding 'local-number' as a fallback sort I explicitly added sorting on 'local-number' - it should be 'local-number__sort' This avoids problems when mappings may be older and local-number itself is indexed as a string and not a number -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 37

[Bug 42766] New: Add ScriptLog syspref and auto-logging for non-cron Koha scripts
by bugzilla-daemon＠bugs.koha-community.org 05 Aug '26

05 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42766 Bug ID: 42766 Summary: Add ScriptLog syspref and auto-logging for non-cron Koha scripts Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Command-line Utilities Assignee: koha-bugs(a)lists.koha-community.org Reporter: martin.renvoize(a)openfifth.co.uk QA Contact: testopia(a)bugs.koha-community.org CC: jake.deery(a)openfifth.co.uk, robin(a)catalyst.net.nz Depends on: 42714 Bug 42714 added automatic CRONJOBS action-log entries (start and end) for scripts that declare themselves as cron jobs via 'use Koha::Script -cron'. That bug deliberately excluded non-cron scripts (admin tools, migration utilities, maintenance scripts) to avoid polluting the CRONJOBS log. This bug extends the same auto-logging idea to all Koha scripts that use bare 'use Koha::Script' (without -cron), gated behind a new ScriptLog system preference that mirrors CronjobLog. Work required: 1. Add a new 'ScriptLog' system preference (type: YesNo, default: 0). 2. Extend the INIT/END blocks in Koha::Script to call a new logscriptaction() function (or reuse/extend cronlogaction()) when ScriptLog is enabled and $_cron is false. The logged module should be distinct from CRONJOBS (e.g. 'SCRIPTS') so admins can filter the two separately in the action log viewer. 3. Implement @ARGV scrubbing before logging. Some scripts accept sensitive values on the command line (passwords, tokens). A concrete example is misc/devel/create_superlibrarian.pl which accepts --password. The mechanism should redact any argument that follows a flag whose name contains 'password', 'passwd', 'secret', 'token', or similar, replacing the value with '[REDACTED]'. Affected scripts (or a central list in Koha::Script) should be able to declare which flags are sensitive. 4. Update the system preferences admin UI (.pref file) to expose ScriptLog alongside or near CronjobLog. 5. Add tests: - Unit test for the @ARGV scrubbing logic. - Verify ScriptLog=0 suppresses logging for non-cron scripts. - Verify ScriptLog=1 creates action log entries for non-cron scripts. Test plan: 1. Apply patch. 2. Enable ScriptLog in Administration > System preferences > Logging. 3. Run a non-cron script, e.g.: perl misc/devel/create_superlibrarian.pl --userid admin --password secret 4. Check Administration > Action logs (module: SCRIPTS) and confirm a Run entry exists with the password value replaced by [REDACTED]. 5. Confirm no entry appears in the CRONJOBS module for this run. 6. Run a cron script, e.g.: perl misc/cronjobs/cleanup_database.pl --confirm 7. Confirm the entry appears under CRONJOBS (not SCRIPTS). 8. Disable ScriptLog and re-run step 3; confirm no log entry is created. 9. Run the test suite: prove t/Koha/Script.t t/Koha/Script_cron.t Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42714 [Bug 42714] Koha::Script should automatically log start and end of scripts when they are run -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 37

[Bug 42360] [CVE-2026-70369] SQL Injection in reports/acquisitions_stats.pl via Filter parameter
by bugzilla-daemon＠bugs.koha-community.org 05 Aug '26

05 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42360 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|SQL Injection in |[CVE-2026-70369] SQL |reports/acquisitions_stats. |Injection in |pl via Filter parameter |reports/acquisitions_stats. | |pl via Filter parameter -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42363] [CVE-2026-70370] SQL Injection in reports/catalogue_stats.pl via the Line request parameter
by bugzilla-daemon＠bugs.koha-community.org 05 Aug '26

05 Aug '26

1 0

[Bug 42368] [CVE-2026-70371] SQL Injection in reports/issues_avg_stats.pl via the Filter request parameter (unvalidated string context, no placeholders)
by bugzilla-daemon＠bugs.koha-community.org 05 Aug '26

05 Aug '26

1 0

[Bug 42369] [CVE-2026-70372] SQL Injection in reports/bor_issues_top.pl via the Filter request parameter (unvalidated string context, no placeholders)
by bugzilla-daemon＠bugs.koha-community.org 05 Aug '26

05 Aug '26

1 0

[Bug 42735] [CVE-2026-70373] SQL Injection in reports/issues_stats.pl via PeriodTypeSel / PeriodDaySel / PeriodMonthSel / Filter parameters (unvalidated string context, no placeholders)
by bugzilla-daemon＠bugs.koha-community.org 05 Aug '26

05 Aug '26

1 0

[Bug 42735] SQL Injection in reports/issues_stats.pl via PeriodTypeSel / PeriodDaySel / PeriodMonthSel / Filter parameters (unvalidated string context, no placeholders)
by bugzilla-daemon＠bugs.koha-community.org 05 Aug '26

05 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42735 --- Comment #12 from Sanjarbiy <sanjarbiy11(a)gmail.com> --- This has been assigned CVE-2026-70373. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42369] SQL Injection in reports/bor_issues_top.pl via the Filter request parameter (unvalidated string context, no placeholders)
by bugzilla-daemon＠bugs.koha-community.org 05 Aug '26

05 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42369 --- Comment #11 from Sanjarbiy <sanjarbiy11(a)gmail.com> --- This has been assigned CVE-2026-70372. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42368] SQL Injection in reports/issues_avg_stats.pl via the Filter request parameter (unvalidated string context, no placeholders)
by bugzilla-daemon＠bugs.koha-community.org 05 Aug '26

05 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42368 --- Comment #20 from Sanjarbiy <sanjarbiy11(a)gmail.com> --- This has been assigned CVE-2026-70371. -- You are receiving this mail because: You are watching all bug changes.

1 0