August 2026 - Koha-bugs - lists.koha-community.org

[Bug 32776] New: Choose to convert oldest reserve or all possible reserves to recalls
by bugzilla-daemon＠bugs.koha-community.org 21 Sep '26

21 Sep '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32776 Bug ID: 32776 Summary: Choose to convert oldest reserve or all possible reserves to recalls Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: aleisha(a)catalyst.net.nz QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com Bug 31415 introduces a script to convert reserves to recalls. By default, it will take the oldest reserve on a record and convert it to a recall. We should be able to customise which reserve(s) are converted to recalls. Options may include: - oldest reserve - one reserve for each issued item available to be recalled -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 32

[Bug 43407] New: Database permissions, different users and "schemas"
by bugzilla-daemon＠bugs.koha-community.org 21 Sep '26

21 Sep '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43407 Bug ID: 43407 Summary: Database permissions, different users and "schemas" Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Database Assignee: koha-bugs(a)lists.koha-community.org Reporter: mark(a)hofstetter.at QA Contact: testopia(a)bugs.koha-community.org Target Milestone: --- A standard Koha instance defines one database account in koha-conf.xml. Koha::Database uses this account for normal DBI and DBIx::Class connections. The Debian installation creates this account with ALL PRIVILEGES on the complete instance database. Consequently, the same database identity is used by the OPAC, staff interface, background workers, command-line tools, database updates, reports, and plugins. It can read and modify operational data, but can also create, alter, and drop database objects. The same logical database/schema contains data with very different ownership and lifecycle requirements: * primary transactional and catalogue data; * configuration and mapping data; * denormalised or generated data; * transient state such as sessions, saved report results, tmp_holdsqueue, and zebraqueue; * plugin-owned tables and indexes. The problem is not merely that Koha uses one database. The problem is the assumption that one highly privileged service account and one schema should be used for every workload. Separate database identities could materially improve security by applying the principle of least privilege. For example: * An OPAC database account could have SELECT access to catalogue, availability, and public configuration data, no access to unrelated tables such as acquisitions or administrative plugin data, and narrowly scoped INSERT or UPDATE permissions only for supported patron operations such as holds, renewals, suggestions, tags, and account changes. It would have no DDL privileges. * A reports account could be strictly read-only. Preferably it would query an allowlisted of tables/views instead of receiving SELECT access to every table. This would also permit sensitive patron, authentication, or financial columns to be excluded or masked. * A staff runtime account could receive the DML permissions required for normal staff operations but no CREATE, ALTER, or DROP privileges. * A dedicated migration account could hold DDL privileges and only be made available while installing or upgrading Koha. Web applications and background workers would not have access to these credentials. * Background workers, search components, and plugins could use separate accounts with permissions limited to their queues, indexes, caches, or plugin-owned schemas. This would reduce the impact of a compromised component. For example, an OPAC vulnerability would not automatically provide access to every Koha table or permit schema changes. A reporting error or malicious report could not modify production records. Separate identities would also improve auditing, credential rotation, and attribution of database activity. Database permissions would not replace Koha's application-level authorization. Some OPAC features require writes, and permissions would need to reflect enabled features. The initial implementation could therefore be optional and use documented privilege profiles rather than attempting an immediate mandatory split. A possible incremental improvement would be support for named database connections in koha-conf.xml. Individual interfaces and components could select an appropriate connection, while the current single-account configuration remains the compatibility default. Such support would need defined behaviour for installation, upgrades, transactions, connection selection, backups/restores, testing, reporting, and deployments where cross-schema foreign keys are unavailable or undesirable. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 7

[Bug 22994] New: Elasticsearch ability import mappings and facets settings
by bugzilla-daemon＠bugs.koha-community.org 18 Sep '26

18 Sep '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22994 Bug ID: 22994 Summary: Elasticsearch ability import mappings and facets settings Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Searching - Elasticsearch Assignee: koha-bugs(a)lists.koha-community.org Reporter: black23(a)gmail.com Target Milestone: --- -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 27

[Bug 21004] New: Use modal to add and edit notes on receiving orders/shipments page
by bugzilla-daemon＠bugs.koha-community.org 18 Sep '26

18 Sep '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=21004 Bug ID: 21004 Summary: Use modal to add and edit notes on receiving orders/shipments page Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Acquisitions Assignee: koha-bugs(a)lists.koha-community.org Reporter: katrin.fischer(a)bsz-bw.de QA Contact: testopia(a)bugs.koha-community.org See bug 20969, but for parcel.pl. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 17

[Bug 43312] New: Migrate opac-user.tt to use api-client.js for article request cancellation
by bugzilla-daemon＠bugs.koha-community.org 18 Sep '26

18 Sep '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43312 Bug ID: 43312 Summary: Migrate opac-user.tt to use api-client.js for article request cancellation Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: tomascohen(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Depends on: 34451 Target Milestone: --- opac-user.tt uses raw jQuery.ajax() for DELETE calls to /api/v1/public/patrons/.../article_requests/.... This needs to be migrated to api-client.js for proper CSRF token handling (bug 34451). -- You are receiving this mail because: You are watching all bug changes.

1 10

[Bug 43311] New: Migrate opac-memberentry.tt to use api-client.js
by bugzilla-daemon＠bugs.koha-community.org 18 Sep '26

18 Sep '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43311 Bug ID: 43311 Summary: Migrate opac-memberentry.tt to use api-client.js Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: tomascohen(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Depends on: 34451 Target Milestone: --- opac-memberentry.tt uses raw jQuery.ajax() for PUT calls to /api/v1/public/patrons/.../guarantors/can_see_checkouts. This needs to be migrated to api-client.js for proper CSRF token handling (bug 34451). -- You are receiving this mail because: You are watching all bug changes.

1 10

[Bug 42386] New: Unify hold availability checks into Koha::Availability pattern
by bugzilla-daemon＠bugs.koha-community.org 18 Sep '26

18 Sep '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42386 Bug ID: 42386 Summary: Unify hold availability checks into Koha::Availability pattern Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: tomascohen(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Depends on: 41728, 42385 Hold availability is currently split across three different interfaces with different return shapes: - Koha::Patron->can_place_holds â patron eligibility gate Returns Koha::Result::Boolean with messages - C4::Reserves::CanItemBeReserved â item-level hold policy Returns hashref with {status} - C4::Reserves::CanBookBeReserved â biblio-level hold policy Returns hashref with {status} This bug proposes unifying these into the Koha::Availability pattern introduced in bug 41728: - Koha::Patron::Hold::Availability â patron eligibility checks (expired, debt, restricted, card lost, global hold limit) - Koha::Item::Hold::Availability â item-level hold policy checks (hold policy, circ rules, on-shelf holds, pickup location, etc.) Both would return Koha::Availability::Result and support no_short_circuit and overrides, consistent with the checkin availability class. This would also require untangling patron-level checks that leaked into CanItemBeReserved (e.g. maxreserves in certain code paths) and pushing them back to the patron-level orchestrator. Note: This is a significant refactoring effort. CanItemBeReserved has ~15 different checks with complex interactions. A multi-patch approach is recommended. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41728 [Bug 41728] Add `Koha::Item::Checkin::Availability` to centralize logic https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42385 [Bug 42385] Extract _GetCircControlBranch into Koha::Policy::Circulation -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 127

[Bug 40626] New: Edit button in item holdings table on bib details page should offer the same options as on Manage Items
by bugzilla-daemon＠bugs.koha-community.org 18 Sep '26

18 Sep '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40626 Bug ID: 40626 Summary: Edit button in item holdings table on bib details page should offer the same options as on Manage Items Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Cataloging Assignee: koha-bugs(a)lists.koha-community.org Reporter: andrew(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: m.de.rooy(a)rijksmuseum.nl On the bib details page (/cgi-bin/koha/catalogue/detail.pl) each item has an Edit button in the holdings table. On the Manage Items page (/cgi-bin/koha/cataloguing/additem.pl) each item gets an Actions button that allows the choice of Edit, Duplicate, Print label, Delete, and OPAC view. If you enable LocalCoverImages, the bib details Edit button gets an added side-option allowing selection of Upload Image with 2 clicks (Edit still only takes 1 click). One cannot add an item-level cover from the manage items page. It would be preferable if these two buttons were identical, with each being the sort of two-part button we see on bib-detail when LocalCoverImages is enabled. The button should select Edit when clicked normally, but also allow a click for additional options Duplicate, Print label, Delete, and OPAC view. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 13

[Bug 33446] New: Revert transit status should have the option to cancel the item transfer as well
by bugzilla-daemon＠bugs.koha-community.org 18 Sep '26

18 Sep '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33446 Bug ID: 33446 Summary: Revert transit status should have the option to cancel the item transfer as well Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Hold requests Assignee: koha-bugs(a)lists.koha-community.org Reporter: emily.lamancusa(a)montgomerycountymd.gov QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Currently, when a hold's transit status is reverted, the item remains in-transit until the transfer is completed by a check-in. This makes sense if the item actually is still in-transit, but there are other situations in which this transit status is incorrect and may not be easy to remove. For example, in our system, we have HoldsAutoFill enabled. Occasionally there are exceptions where we don't want a book to be put in transit for a hold, but instead to remain available at its home branch. If the staff member reverts the transit status on the hold, the item still shows as In Transit. But they can't check in the item to complete the transfer without causing the hold to trap again. In this situation, the book shouldn't be showing as In Transit, but there's no simple way to remove that status. It's several extra steps at best to manually cancel the transfer (and most of our staff don't know how to do this, as manual transfers are not a normal part of our workflow, so many items retain an incorrect "In transit" status indefinitely). When a hold's transit status is reverted by the sending librarian because they're not planning on sending the book for whatever reason, it would be great if they could revert the hold transit status and cancel the item transfer all in one step. This could be something as simple as a checkbox option or a drop-down, so that the user can choose between "Revert transit status" versus "Revert transit status and cancel item transfer". -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 15

[Bug 43108] New: Add a REST API endpoint for a biblio's booking availability over a date range
by bugzilla-daemon＠bugs.koha-community.org 18 Sep '26

18 Sep '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43108 Bug ID: 43108 Summary: Add a REST API endpoint for a biblio's booking availability over a date range Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: paul.derscheid(a)lmscloud.de QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle(a)bywatersolutions.com Target Milestone: --- Booking availability (which of a record's bookable items can be booked on which dates, given the lead/trail circulation rules, existing bookings, current checkouts, and the pickup library's closed days) is computed server-side as the single source of truth and exposed over REST. One implementation backs both display and enforcement so they cannot drift; the server returns a compact per-date map rather than making each consumer fetch and process all of a record's bookings and checkouts; and any consumer, whether the Vue booking modal (Bug 41129), another UI, or a third-party integration building its own booking flow, can query it without re-implementing the rules. GET /biblios/{biblio_id}/booking_availability ?from_date=YYYY-MM-DD&to_date=YYYY-MM-DD (required, inclusive, <= 366 days) [&pickup_library_id=...] [&patron_id=...] [&item_type_id=...] [&item_id=...] [&excluded_booking_id=...] (rule/context + edit-exclude) It returns the bookable item ids and a sparse per-(date, item) map. Each cell is an availability result: { "item_ids": [101, 102], "availability": { "2026-08-10": { "101": { "blockers": { "booking": 1 }, "confirms": {}, "warnings": {} }, "102": { "blockers": { "lead": 1 }, "confirms": {}, "warnings": { "holiday": 1 } } } } } - blockers prevent a new booking (booking, checkout, lead, trail); an item with no blockers on a date is bookable, so its available dates are the complement. - warnings are advisory display context only (holiday, lead_floor, lead_theoretical). - confirms is always empty for bookings but present so each cell is a complete availability result. The response shape follows the availability-class pattern currently being established: Bug 41728 (Koha::Result::Availability, to_hashref, where each cell is that shape); Bug 42386 (Koha::{Patron,Item,Biblio}::Availability::Hold, which sets the namespace and snake_case reasons; the class here is Koha::Biblio::Availability::Booking); Bug 42385 and Bug 42387. To stay more or less independent of that series, the class returns a plain hashref rather than subclassing the not-yet-merged Koha::Result::Availability; the shape is compatible, so switching to the real object later is a drop-in change. Booking and checkout day boundaries are attributed to the library timezone (consistent with Bug 42868), matching how bookings are stored and enforced. When item_id names a single item, its own effective item type governs the lead/trail rules (the type enforcement will use), overriding any item_type_id passed alongside it. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 40