August 2026 - Koha-bugs - lists.koha-community.org

[Bug 30233] [ZDI-CAN-29165] Remote code execution in user-supplied regex
by bugzilla-daemon＠bugs.koha-community.org 11 Aug '26

11 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30233 Pedro Amorim (ammopt) <pedro.amorim(a)openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)|26.05.02,25.05.13,25.11.07, |26.11.00,26.05.02,25.11.07, released in|24.11.18 |25.05.13,24.11.18 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42471] /cgi-bin/koha/suggestion/suggestion.pl Multiple Parameters Stored Cross-Site Scripting
by bugzilla-daemon＠bugs.koha-community.org 11 Aug '26

11 Aug '26

1 0

[Bug 42746] Stored SQL injection via unvalidated 'agefield' in automatic_item_modification_by_age (C4::Items::ToggleNewStatus)
by bugzilla-daemon＠bugs.koha-community.org 11 Aug '26

11 Aug '26

1 0

[Bug 42747] Stored SQL injection via patroncard layout image_name (patroncards/edit-layout.pl -> create-pdf.pl)
by bugzilla-daemon＠bugs.koha-community.org 11 Aug '26

11 Aug '26

1 0

[Bug 42749] SQL injection in acqui/parcels.pl via the orderby parameter (ORDER BY direction) reaching C4::Acquisition::GetInvoices
by bugzilla-daemon＠bugs.koha-community.org 11 Aug '26

11 Aug '26

1 0

[Bug 42847] SIP authentication ignored after initial successful connection
by bugzilla-daemon＠bugs.koha-community.org 11 Aug '26

11 Aug '26

1 0

[Bug 42866] SQL Injection in Koha/AdditionalContents.pm search_for_display via the patron lang value (stored / second-order, executed on issue-slip print, unvalidated string context, no placeholder)
by bugzilla-daemon＠bugs.koha-community.org 11 Aug '26

11 Aug '26

1 0

[Bug 43019] OPAC pages limited to library are readable by unauthenticated users
by bugzilla-daemon＠bugs.koha-community.org 11 Aug '26

11 Aug '26

1 0

[Bug 30233] [ZDI-CAN-29165] Remote code execution in user-supplied regex
by bugzilla-daemon＠bugs.koha-community.org 11 Aug '26

11 Aug '26

1 0

[Bug 43246] New: Entering dates with a keyboard creates due dates with time set to 00:00
by bugzilla-daemon＠bugs.koha-community.org 11 Aug '26

11 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43246 Bug ID: 43246 Summary: Entering dates with a keyboard creates due dates with time set to 00:00 Initiative type: --- Sponsorship --- status: Product: Koha Version: 25.05 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Tools Assignee: koha-bugs(a)lists.koha-community.org Reporter: janne.seppanen(a)lahti.fi QA Contact: testopia(a)bugs.koha-community.org Target Milestone: --- One can enter due dates manually with the current datepicker in Koha. When picking dates from the calendar widget, Koha creates due dates with 23:59 as the latest return time on that date. However, when entering the date with a keyboard the time sets to 00:00, meaning that if the patron returns their loans on the due date, they're already late. There seems to have been a similar bug with the old date widget, maybe this bug has returned with the release of the new datepicker widget? https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34939 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 1