August 2026 - Koha-bugs - lists.koha-community.org

[Bug 37974] New: Notices should list the available objects
by bugzilla-daemon＠bugs.koha-community.org 19 Aug '26

19 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37974 Bug ID: 37974 Summary: Notices should list the available objects Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Notices Assignee: koha-bugs(a)lists.koha-community.org Reporter: nick(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org When editing a notice in the staff interface there is no way to know which objects are available to the template without reading the code. We should list the available objects to make writing notices easier -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 1

[Bug 41129] New: Migrate place_booking.js to a Vue island.
by bugzilla-daemon＠bugs.koha-community.org 19 Aug '26

19 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41129 Bug ID: 41129 Summary: Migrate place_booking.js to a Vue island. Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: paul.derscheid(a)lmscloud.de QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle(a)bywatersolutions.com Since the bookings functionality requires a significant amount of reactivity due to many interdependent inputs to achieve a good UX, this bug is intended to deprecate place_booking.js in favor of a Vue island that makes this much easier. The goal here is to have a Vue based component that is used for the Staff Interface as well as the OPAC to avoid duplication and diverging implementations and also makes it easier to keep track of problems that then don't need to be fixed in two places. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 138

[Bug 43301] New: Koha::Patron->libraries_where_can_see_things() returns incorrect results
by bugzilla-daemon＠bugs.koha-community.org 19 Aug '26

19 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43301 Bug ID: 43301 Summary: Koha::Patron->libraries_where_can_see_things() returns incorrect results Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: dcook(a)prosentient.com.au QA Contact: testopia(a)bugs.koha-community.org Target Milestone: --- If you create a number of overdues and then go to /cgi-bin/koha/circ/overdue.pl with a user account that doesn't have borrowers > view_borrower_infos_from_any_libraries permission, you will see overdues for all libraries, but you can only filter "Library of the patron" from your own library. This is because "Koha::Patron->libraries_where_can_see_things" returns only the user's branchcode if there are no library groups defined, which... makes no sense. If there are no library groups, then all library branches should be returned. It gets worse... if there is at least 1 library group defined, the patrons from any other branch but your own will have their information hidden (eg A patron from library) even if that library group has no libraries in it! -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 6

[Bug 43299] New: Add class to shelving location column in staff interface in order to allow styling
by bugzilla-daemon＠bugs.koha-community.org 19 Aug '26

19 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43299 Bug ID: 43299 Summary: Add class to shelving location column in staff interface in order to allow styling Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Staff interface Assignee: koha-bugs(a)lists.koha-community.org Reporter: andrew(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Target Milestone: --- Libraries sometimes wish to draw special attention to specific shelving locations within the holdings table on a bib record -- like when an item is at the CART location after being returned. A class around the value would make it easy to style with CSS. The class would want to include the code for the shelving location ("loc-cart" or "loc-fic"). -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 19

[Bug 6892] If a URL has been entered without http://, it isn't correctly linked
by bugzilla-daemon＠bugs.koha-community.org 19 Aug '26

19 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6892 Lisette Scheer <lisette(a)bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|koha-bugs(a)lists.koha-commun |paul.derscheid(a)lmscloud.de |ity.org | CC| |lisette(a)bywatersolutions.co | |m -- You are receiving this mail because: You are the QA Contact for the bug. You are watching all bug changes.

1 0

[Bug 43307] New: Migrate cataloguing/moveitem.tt to use api-client.js
by bugzilla-daemon＠bugs.koha-community.org 19 Aug '26

19 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43307 Bug ID: 43307 Summary: Migrate cataloguing/moveitem.tt to use api-client.js Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: tomascohen(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Depends on: 34451 Target Milestone: --- cataloguing/moveitem.tt uses raw jQuery.ajax() for DELETE calls to /api/v1/biblios/.... These need to be migrated to api-client.js for proper CSRF token handling (bug 34451). -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 6

[Bug 43311] New: Migrate opac-memberentry.tt to use api-client.js
by bugzilla-daemon＠bugs.koha-community.org 19 Aug '26

19 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43311 Bug ID: 43311 Summary: Migrate opac-memberentry.tt to use api-client.js Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: tomascohen(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Depends on: 34451 Target Milestone: --- opac-memberentry.tt uses raw jQuery.ajax() for PUT calls to /api/v1/public/patrons/.../guarantors/can_see_checkouts. This needs to be migrated to api-client.js for proper CSRF token handling (bug 34451). -- You are receiving this mail because: You are watching all bug changes.

1 7

[Bug 43312] New: Migrate opac-user.tt to use api-client.js for article request cancellation
by bugzilla-daemon＠bugs.koha-community.org 19 Aug '26

19 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43312 Bug ID: 43312 Summary: Migrate opac-user.tt to use api-client.js for article request cancellation Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: tomascohen(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Depends on: 34451 Target Milestone: --- opac-user.tt uses raw jQuery.ajax() for DELETE calls to /api/v1/public/patrons/.../article_requests/.... This needs to be migrated to api-client.js for proper CSRF token handling (bug 34451). -- You are receiving this mail because: You are watching all bug changes.

1 7

[Bug 43334] New: Implement OIDC Third-Party Initiated Login endpoint
by bugzilla-daemon＠bugs.koha-community.org 19 Aug '26

19 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43334 Bug ID: 43334 Summary: Implement OIDC Third-Party Initiated Login endpoint Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Authentication Assignee: koha-bugs(a)lists.koha-community.org Reporter: tomascohen(a)gmail.com QA Contact: martin.renvoize(a)openfifth.co.uk CC: dpavlin(a)rot13.org Depends on: 42719 Target Milestone: --- Bug 42719 fixes the immediate 500 crash when an IdP initiates login without an existing session. However, the current approach silently creates a session and proceeds, which is susceptible to login CSRF (an attacker could craft a link that initiates login on behalf of the user). The OIDC spec defines a proper Third-Party Initiated Login flow: https://openid.net/specs/openid-connect-core-1_0.html#ThirdPartyInitiatedLo… Proposed implementation: 1. New endpoint: GET /api/v1/public/oauth/initiate-login Parameters (per spec): - iss (required): issuer identifier, must match a configured provider - login_hint (optional): hint about which user to authenticate - target_link_uri (optional): where to redirect after login 2. The endpoint: - Validates iss against configured OAuth providers in koha-conf.xml - Returns 400 if iss does not match any known provider - Renders a confirmation page: 'Provider X is requesting login. Proceed?' - On confirmation, redirects to the existing /api/v1/public/oauth/login/{provider}/{interface} flow 3. This defeats login CSRF because: - User interaction is required before the OAuth dance begins - The session and CSRF state are only created after user consent The existing Mojolicious::Plugin::OAuth2 flow remains unchanged. This endpoint sits in front of it, resolving iss to a provider name and gating on user confirmation. The session-creation logic from bug 42719 remains useful: after user confirms, the login endpoint may still need to create a session if none exists. Libraries using Okta (or similar IdPs) would configure the initiate_login_uri in their IdP app settings to point to this endpoint. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42719 [Bug 42719] OAuth/OIDC login crashes with 500 when no CGISESSID cookie exists (IdP-initiated flow) -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 2

[Bug 41608] New: Ability to select multiple values of a facet in the professional interface
by bugzilla-daemon＠bugs.koha-community.org 19 Aug '26

19 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41608 Bug ID: 41608 Summary: Ability to select multiple values of a facet in the professional interface Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Searching Assignee: koha-bugs(a)lists.koha-community.org Reporter: mathsabypro(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org In the professional interface, we should be able to select several values from a facet in a single operation (e.g., several libraries, several languages, etc.), so that Koha applies the "OR" operator between each value (e.g., return documents present in library A or library B) -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 56