August 2026 - Koha-bugs - lists.koha-community.org

[Bug 42735] SQL Injection in reports/issues_stats.pl via PeriodTypeSel / PeriodDaySel / PeriodMonthSel / Filter parameters (unvalidated string context, no placeholders)
by bugzilla-daemon＠bugs.koha-community.org 05 Aug '26

05 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42735 --- Comment #12 from Sanjarbiy <sanjarbiy11(a)gmail.com> --- This has been assigned CVE-2026-70373. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42369] SQL Injection in reports/bor_issues_top.pl via the Filter request parameter (unvalidated string context, no placeholders)
by bugzilla-daemon＠bugs.koha-community.org 05 Aug '26

05 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42369 --- Comment #11 from Sanjarbiy <sanjarbiy11(a)gmail.com> --- This has been assigned CVE-2026-70372. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42368] SQL Injection in reports/issues_avg_stats.pl via the Filter request parameter (unvalidated string context, no placeholders)
by bugzilla-daemon＠bugs.koha-community.org 05 Aug '26

05 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42368 --- Comment #20 from Sanjarbiy <sanjarbiy11(a)gmail.com> --- This has been assigned CVE-2026-70371. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42363] SQL Injection in reports/catalogue_stats.pl via the Line request parameter
by bugzilla-daemon＠bugs.koha-community.org 05 Aug '26

05 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42363 --- Comment #11 from Sanjarbiy <sanjarbiy11(a)gmail.com> --- This has been assigned CVE-2026-70370. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42360] SQL Injection in reports/acquisitions_stats.pl via Filter parameter
by bugzilla-daemon＠bugs.koha-community.org 05 Aug '26

05 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42360 --- Comment #38 from Sanjarbiy <sanjarbiy11(a)gmail.com> --- This has been assigned CVE-2026-70369. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 43224] New: Wrong op value add_item in additem.tt
by bugzilla-daemon＠bugs.koha-community.org 05 Aug '26

05 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43224 Bug ID: 43224 Summary: Wrong op value add_item in additem.tt Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Cataloging Assignee: koha-bugs(a)lists.koha-community.org Reporter: emmi.takkinen(a)koha-suomi.fi QA Contact: testopia(a)bugs.koha-community.org CC: m.de.rooy(a)rijksmuseum.nl Target Milestone: --- There is a wrong op value "add_item" in additem.tt line 401. Value should be "cud-additem". This has probably caused some issues, but to be honest I don't really understand why we need to add hidden itemnumber to the form when we already to it in line 294. Because of this when form is now send, both itemnumbers are send to the back-end as hash. But nevertheless, value should probably be fixed. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 1

[Bug 33756] New: Wrong calculation of total amount spent?
by bugzilla-daemon＠bugs.koha-community.org 05 Aug '26

05 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33756 Bug ID: 33756 Summary: Wrong calculation of total amount spent? Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Acquisitions Assignee: koha-bugs(a)lists.koha-community.org Reporter: katrin.fischer(a)bsz-bw.de QA Contact: testopia(a)bugs.koha-community.org I am trying to work out something in acquisitions and stumbled on this bit: https://git.koha-community.org/Koha-community/Koha/src/branch/master/C4/Bud… # Get all the budgets totals in as few queries as possible my $hr_budget_spent = $dbh->selectall_hashref(q| SELECT aqorders.budget_id, aqbudgets.budget_parent_id, SUM( | . C4::Acquisition::get_rounding_sql(qq|COALESCE(unitprice_tax_included, ecost_tax_included)|) . q| * quantity ) AS budget_spent FROM aqorders JOIN aqbudgets USING (budget_id) WHERE quantityreceived > 0 AND datecancellationprinted IS NULL GROUP BY budget_id, budget_parent_id |, 'budget_id'); If the amount is spent, I feel multiplying by quantity is incorrect. It should be quantityreceived. I am not sure yet where this is used and how it manifests. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 14

[Bug 43226] New: Change AUTO_RENEWAL and AUTO_RENEWAL_DGST to AUTO_RENEWALS and AUTO_RENEWALS_DGST
by bugzilla-daemon＠bugs.koha-community.org 04 Aug '26

04 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43226 Bug ID: 43226 Summary: Change AUTO_RENEWAL and AUTO_RENEWAL_DGST to AUTO_RENEWALS and AUTO_RENEWALS_DGST Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Documentation Assignee: koha-bugs(a)lists.koha-community.org Reporter: caroline.cyr-la-rose(a)inlibro.com QA Contact: testopia(a)bugs.koha-community.org CC: aude.charillon(a)openfifth.co.uk, david(a)davidnind.com, philip.orr(a)lmscloud.de Target Milestone: --- The manual has the code AUTO_RENEWAL and AUTO_RENEWAL_DGST (renewal singular), but the letter codes in Koha are plural AUTO_RENEWALS and AUTO_RENEWALS_DGST. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 2

[Bug 42291] New: Tidy all script tags - shelves
by bugzilla-daemon＠bugs.koha-community.org 04 Aug '26

04 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42291 Bug ID: 42291 Summary: Tidy all script tags - shelves Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: jonathan.druart(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Blocks: 42094 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42094 [Bug 42094] Tidy all script tags (except value_builder) -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 34

[Bug 41839] New: Update MARC framework pages to use grid layout for forms
by bugzilla-daemon＠bugs.koha-community.org 04 Aug '26

04 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41839 Bug ID: 41839 Summary: Update MARC framework pages to use grid layout for forms Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Templates Assignee: oleonard(a)myacpl.org Reporter: oleonard(a)myacpl.org QA Contact: testopia(a)bugs.koha-community.org CC: testopia(a)bugs.koha-community.org Depends on: 41827 - Administration -> MARC bibliographic framework -> New framework - Administration -> MARC bibliographic framework -> MARC structure -> New tag - Administration -> MARC bibliographic framework -> MARC structure -> Actions -> Edit subfields. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41827 [Bug 41827] Update authority types pages to use grid layout for forms -- You are receiving this mail because: You are watching all bug changes.

1 13