September 2026 - Koha-bugs - lists.koha-community.org

[Bug 2172] Cart attaches an iso2709 file, which can be confusing
by bugzilla-daemon＠bugs.koha-community.org 03 Sep '26

03 Sep '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=2172 Lisette Scheer <lisette(a)bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact| |testopia(a)bugs.koha-communit | |y.org -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 43389] Remove conditional TT tags from tables thead (Holdings tables)
by bugzilla-daemon＠bugs.koha-community.org 03 Sep '26

03 Sep '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43389 Lisette Scheer <lisette(a)bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia(a)bugs.koha-communit |andrew(a)bywatersolutions.com |y.org | -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 43438] New: All Vue datatables export the actions column
by bugzilla-daemon＠bugs.koha-community.org 03 Sep '26

03 Sep '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43438 Bug ID: 43438 Summary: All Vue datatables export the actions column Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: matt.blenkinsop(a)openfifth.co.uk QA Contact: testopia(a)bugs.koha-community.org Target Milestone: --- All tables in Vue applications export the actions column as they are missing the no-export class -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 10

[Bug 43318] New: Remove event attributes from patron_messages.inc
by bugzilla-daemon＠bugs.koha-community.org 03 Sep '26

03 Sep '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43318 Bug ID: 43318 Summary: Remove event attributes from patron_messages.inc Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Circulation Assignee: oleonard(a)myacpl.org Reporter: oleonard(a)myacpl.org QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle(a)bywatersolutions.com Blocks: 38407 Target Milestone: --- There are a couple of event attributes in patron_messages.inc which can be moved to members-menu.js. These click events are meant to trigger tabs on either the checkout or the patron detail page. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38407 [Bug 38407] Eliminate event handler attributes in the staff interface -- You are receiving this mail because: You are watching all bug changes.

1 10

[Bug 42866] SQL Injection in Koha/AdditionalContents.pm search_for_display via the patron lang value (stored / second-order, executed on issue-slip print, unvalidated string context, no placeholder)
by bugzilla-daemon＠bugs.koha-community.org 03 Sep '26

03 Sep '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42866 --- Comment #17 from Sanjarbiy <sanjarbiy11(a)gmail.com> --- This has been assigned CVE-2026-72610. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42749] SQL injection in acqui/parcels.pl via the orderby parameter (ORDER BY direction) reaching C4::Acquisition::GetInvoices
by bugzilla-daemon＠bugs.koha-community.org 03 Sep '26

03 Sep '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42749 --- Comment #10 from Sanjarbiy <sanjarbiy11(a)gmail.com> --- This has been assigned CVE-2026-72609. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42747] Stored SQL injection via patroncard layout image_name (patroncards/edit-layout.pl -> create-pdf.pl)
by bugzilla-daemon＠bugs.koha-community.org 03 Sep '26

03 Sep '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42747 --- Comment #14 from Sanjarbiy <sanjarbiy11(a)gmail.com> --- This has been assigned CVE-2026-72608. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42746] Stored SQL injection via unvalidated 'agefield' in automatic_item_modification_by_age (C4::Items::ToggleNewStatus)
by bugzilla-daemon＠bugs.koha-community.org 03 Sep '26

03 Sep '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42746 --- Comment #16 from Sanjarbiy <sanjarbiy11(a)gmail.com> --- This has been assigned CVE-2026-72607. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 40159] New: When modifying a subscription with received issues, prediction pattern doesn't start from next issue date
by bugzilla-daemon＠bugs.koha-community.org 03 Sep '26

03 Sep '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40159 Bug ID: 40159 Summary: When modifying a subscription with received issues, prediction pattern doesn't start from next issue date Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Serials Assignee: koha-bugs(a)lists.koha-community.org Reporter: arthur.suzuki(a)biblibre.com QA Contact: testopia(a)bugs.koha-community.org To reproduce the issue : Make a record and create a subscription for this record with a week or month subscription length and a first issue date in the past (like 2016). Receive at least one issue. Edit the subscription and test the prediction pattern. The displayed prediction shows only one number (unless you set the subscription length for like a thousand issues). -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 16

[Bug 33276] New: Library limitations will cause data loss when editing serials
by bugzilla-daemon＠bugs.koha-community.org 03 Sep '26

03 Sep '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33276 Bug ID: 33276 Summary: Library limitations will cause data loss when editing serials Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Serials Assignee: koha-bugs(a)lists.koha-community.org Reporter: thibaud.guillot(a)biblibre.com QA Contact: testopia(a)bugs.koha-community.org Hello @ll, This bug can be related to 31422 and 32748. That's the same behavior on "Locations" dropdown list for serials. When a value is limited to a library if we're logging with a patron from another lib, the location value is empty and can be replaced. I copied the same logic as the submitted patch for 32748. We can modify the value but the current value (provides from another lib) stay in dropdown. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 14