August 2026 - Koha-bugs - lists.koha-community.org

[Bug 43335] New: Note field in Accounting is inconsistently typed
by bugzilla-daemon＠bugs.koha-community.org 18 Aug '26

18 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43335 Bug ID: 43335 Summary: Note field in Accounting is inconsistently typed Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: trivial Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: dcook(a)prosentient.com.au QA Contact: testopia(a)bugs.koha-community.org Target Milestone: --- On the patron's Accounting page, in the "Create manual invoice", "Create manual credit", and "Make a payment" tabs the "Note" is an input box but in "Transactions" it's a textbox which can include new lines which are converted to <br>. This is a weird inconsistency. Do we want them all to be textboxes or them all to be text inputs? -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 1

[Bug 42471] [CVE-2026-41921] /cgi-bin/koha/suggestion/suggestion.pl Multiple Parameters Stored Cross-Site Scripting
by bugzilla-daemon＠bugs.koha-community.org 18 Aug '26

18 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42471 --- Comment #32 from David Cook <dcook(a)prosentient.com.au> --- (In reply to wsparks from comment #31) > The VulnCheck CVE Numbering Authority (CNA) will be publishing > CVE-2026-41921 to identify this vulnerability. Thanks. I've updated the report title to include it. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42471] [CVE-2026-41921] /cgi-bin/koha/suggestion/suggestion.pl Multiple Parameters Stored Cross-Site Scripting
by bugzilla-daemon＠bugs.koha-community.org 18 Aug '26

18 Aug '26

1 0

[Bug 8127] Most-circulated items report doesn't work when limited by library
by bugzilla-daemon＠bugs.koha-community.org 18 Aug '26

18 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8127 Wainui Witika-Park <wainuiwitikapark(a)catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|26.11.00,26.05.03 |26.11.00,26.05.03,25.05.14 released in| | CC| |wainuiwitikapark(a)catalyst.n | |et.nz --- Comment #15 from Wainui Witika-Park <wainuiwitikapark(a)catalyst.net.nz> --- Applied to 25.05 for 25.05.14 (needed for 42736) -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42295] New: Tidy all script tags - includes staff
by bugzilla-daemon＠bugs.koha-community.org 18 Aug '26

18 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42295 Bug ID: 42295 Summary: Tidy all script tags - includes staff Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: jonathan.druart(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Blocks: 42094 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42094 [Bug 42094] Tidy all script tags (except value_builder) -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 59

[Bug 35870] New: Adding an edit_authorities subpermission for editauthorities
by bugzilla-daemon＠bugs.koha-community.org 18 Aug '26

18 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35870 Bug ID: 35870 Summary: Adding an edit_authorities subpermission for editauthorities Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Staff interface Assignee: koha-bugs(a)lists.koha-community.org Reporter: wainuiwitikapark(a)catalyst.net.nz QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 47

[Bug 43155] New: POS breaks on modal if change required
by bugzilla-daemon＠bugs.koha-community.org 18 Aug '26

18 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43155 Bug ID: 43155 Summary: POS breaks on modal if change required Initiative type: --- Sponsorship --- status: Product: Koha Version: 25.11 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Point of Sale Assignee: koha-bugs(a)lists.koha-community.org Reporter: cbrannon(a)cdalibrary.org QA Contact: martin.renvoize(a)openfifth.co.uk Target Milestone: --- This only happens if the patron is owed change. If we enter in an exact amount tendered, everything works. We are seeing a bug with the POS. If I have an amount owed in the POS, like $1.25, and I enter $2.00 tendered, and press confirm, a modal comes up asking to confirm the change owed. If I press yes, nothing happens. If I run console.log("Koha:", Koha); console.log("Koha.prefs:", Koha?.prefs); directly in the browser console on that page, I get: Koha: { ... } Koha.prefs: undefined It looks like Koha.prefs is not being initialized. If I run this in the console on that page: Koha.prefs = Koha.prefs || {}; Koha.prefs.FinePaymentAutoPopup = false; Then I enter the amount tendered over the amount owed, the confirmation comes up, I press yes, and it works. I temporary workaround I've come up with seems to get us by for the moment: //TEMPORARY Workaround for POS bug - 7/22/26 $(function () { Koha = window.Koha || {}; Koha.prefs = Koha.prefs || {}; }); //TEMPORARY Workaround for POS bug - 7/22/26 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 19

[Bug 42471] /cgi-bin/koha/suggestion/suggestion.pl Multiple Parameters Stored Cross-Site Scripting
by bugzilla-daemon＠bugs.koha-community.org 18 Aug '26

18 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42471 --- Comment #31 from wsparks(a)vulncheck.com --- The VulnCheck CVE Numbering Authority (CNA) will be publishing CVE-2026-41921 to identify this vulnerability. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42404] New: Add a batch cover images upload endpoint
by bugzilla-daemon＠bugs.koha-community.org 18 Aug '26

18 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42404 Bug ID: 42404 Summary: Add a batch cover images upload endpoint Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: REST API Assignee: koha-bugs(a)lists.koha-community.org Reporter: tomascohen(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org CC: tomascohen(a)gmail.com -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 60

[Bug 36369] New: Make APIClient be more useful
by bugzilla-daemon＠bugs.koha-community.org 18 Aug '26

18 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36369 Bug ID: 36369 Summary: Make APIClient be more useful Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: tomascohen(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org I file this report for discussion. In my opinion, there's too much duplicated code on the API client libraries. And the APIClient "class" is just a shortcut to avoid instantiating the module-specific API clients: ```javascript import ERMAPIClient from "./erm-api-client"; ... export const APIClient = { erm: new ERMAPIClient(), ``` Then used everywhere like this: ```javascript import { APIClient } from "../../fetch/api-client.js" ... const client = APIClient.erm await client.agreements.count().then( ``` IMHO, we need a real APIClient class that would implement generic methods like: ```javascript create: params => this.post({ endpoint: params.endpoint ? params.endpoint : "/", body: params.resource, headers: params.headers }), ... getAll: params => this.get({ endpoint: params.endpoint ? params.endpoint : "/", params.query, headers: params.headers, }), ... count: params => this.count({ endpoint: params.endpoint ? params.endpoint : "/", "?" + new URLSearchParams({ _page: 1, _per_page: 1, ...(params.query && { q: JSON.stringify(params.query) }), }), }), ``` and the API Client classes (like ERMAPIClient) should inherit from it, somehow. For doing so, we will face another design roadblock: While I uderstand that ERMAPIClient is a single place to have all the ERM module-needed API actions, it still feels weird from an OOP perspective how things are organized. I feel like we should have individual classes, like: ```javascript export RecordSourcesAPIClient extends APIClient ``` and then have a new type of class along this lines: ```javascript import CitiesAPIClient from "./cities-api-client"; import RecordSourcesAPIClient from "./record-sources-api-client"; ... export const AdminAPIClient = { cities: new CitiesAPIClient(), record_sources: new RecordSourcesAPIClient(), ... }; ``` this way, we will avoid repeating ourselves (less bugs!) and the code is (I expect) more reusable. I also think the `embed` handling should just be a list for the different methods, like: embed: [ 'patron', 'patron.category' ] and generically handled by APIClient. No need to build the headers manually everywhere. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 59