- Koha-bugs - lists.koha-community.org

[Bug 36818] Remote-Code-Execution (RCE) in upload-cover-image.pl (CVE-2024-36057)
by bugzilla-daemon＠bugs.koha-community.org 02 May '25

02 May '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36818 --- Comment #34 from Martin Renvoize (ashimema) <martin.renvoize(a)openfifth.co.uk> --- *** Bug 27941 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0

[Bug 36867] ILS-DI AuthorizedIPs should deny explicitly except those listed
by bugzilla-daemon＠bugs.koha-community.org 02 May '25

02 May '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36867 Katrin Fischer <katrin.fischer(a)bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|additional_work_needed | --- Comment #30 from Katrin Fischer <katrin.fischer(a)bsz-bw.de> --- Follow-up pushed! -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 31988] New: manager.pl is only user for "Catalog by item type" report
by bugzilla-daemon＠bugs.koha-community.org 02 May '25

02 May '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31988 Bug ID: 31988 Summary: manager.pl is only user for "Catalog by item type" report Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Reports Assignee: koha-bugs(a)lists.koha-community.org Reporter: nick(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org This is an odd script - it looks like the intent was to have one script that could call various reports. We have a single "plugin" for the reports - itemtypes.plugin We should convert this to a regular report script -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 23

[Bug 38092] New: members/files, acqui/invoice-files: Could create memory issues, handling larger files
by bugzilla-daemon＠bugs.koha-community.org 02 May '25

02 May '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38092 Bug ID: 38092 Summary: members/files, acqui/invoice-files: Could create memory issues, handling larger files Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: m.de.rooy(a)rijksmuseum.nl QA Contact: testopia(a)bugs.koha-community.org Triggered by looking at bug 37365, I notice that members/files does read the contents of a file into a variable before uploading it. while (<$uploaded_file>) { $file_content .= $_; } This is passed to Koha/Patron/Files, sub AddFile. Which does a direct SQL INSERT into borrower_files without checking size etc. Note that we also have Koha/Misc/Files.pm which also has a similar sub AddFile and contains code to insert file contents into table misc_files. Seems to be used in ACQ context only. So we have the same kind of problem in acqui/invoice-files.pl: my $file_content = do { local $/; <$uploaded_file>; }; No checks either. The scope of this problem is somehow reduced by the fact that we luckily have no OPAC counterparts for those actions. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 5

[Bug 39808] New: Updating configuration on plugin does not change the last updated date
by bugzilla-daemon＠bugs.koha-community.org 02 May '25

02 May '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39808 Bug ID: 39808 Summary: Updating configuration on plugin does not change the last updated date Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: System Administration Assignee: koha-bugs(a)lists.koha-community.org Reporter: cbrannon(a)cdalibrary.org QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com I just made an update to the OpenAthens plugin configuration and the last updated date did not change. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 1

[Bug 32962] New: Add ability to enable/disable Authorities module
by bugzilla-daemon＠bugs.koha-community.org 01 May '25

01 May '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32962 Bug ID: 32962 Summary: Add ability to enable/disable Authorities module Change sponsored?: --- Product: Koha Version: 21.11 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: System Administration Assignee: koha-bugs(a)lists.koha-community.org Reporter: catrina(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com The Authorities module can be hidden in the staff interface by using IntranetUserJS, but just like the following modules/features can be enabled/disabled or set to use/don't use, it would be nice to have this functionality in system preferences to turn on/off the Authorities module as well. Existing features set in system preferences: ERMModule (Enable/Disable) CurbsidePickup (Enable/Disable) ILLModule (Enable/Disable) UseCourseReserves (Use/Don’t Use) EnablePointOfSale (Enable/Disable) -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 3

[Bug 32963] New: Add ability to enable/disable Acquisitions module
by bugzilla-daemon＠bugs.koha-community.org 01 May '25

01 May '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32963 Bug ID: 32963 Summary: Add ability to enable/disable Acquisitions module Change sponsored?: --- Product: Koha Version: 21.11 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: System Administration Assignee: koha-bugs(a)lists.koha-community.org Reporter: catrina(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com The Acquisitions module can be hidden in the staff interface by using IntranetUserJS, but just like the following modules/features can be enabled/disabled or set to use/don't use, it would be nice to have this functionality in system preferences to turn on/off the Acquisitions module as well. Existing features set in system preferences: ERMModule (Enable/Disable) CurbsidePickup (Enable/Disable) ILLModule (Enable/Disable) UseCourseReserves (Use/Don’t Use) EnablePointOfSale (Enable/Disable) -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 6

[Bug 39804] New: Circulation rule editor row should appear in sticky header
by bugzilla-daemon＠bugs.koha-community.org 01 May '25

01 May '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39804 Bug ID: 39804 Summary: Circulation rule editor row should appear in sticky header Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: System Administration Assignee: koha-bugs(a)lists.koha-community.org Reporter: cbrannon(a)cdalibrary.org QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com When editing a circulation rule, the bottom row of the table is duplicated with the rule you want to edit. It would be less disorienting and more efficient if this row appeared in a sticky header. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 2

[Bug 39803] New: Circ rules needs check boxes and bulk editing
by bugzilla-daemon＠bugs.koha-community.org 01 May '25

01 May '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39803 Bug ID: 39803 Summary: Circ rules needs check boxes and bulk editing Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: System Administration Assignee: koha-bugs(a)lists.koha-community.org Reporter: cbrannon(a)cdalibrary.org QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Could we have checkboxes next to circulation rules, and when something is checked, editor fields appear at the top of the screen for each column. Fill in the bits want to change and apply, and it will only apply filled in columns to the checked items. Blank fields are left alone. We could have check boxes under the editable fields for each column to clear the information. If that is check, the info for that column is cleared for those checked items. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 1

[Bug 39806] New: Default checkout, hold and return policy should have a set and expiration date
by bugzilla-daemon＠bugs.koha-community.org 01 May '25

01 May '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39806 Bug ID: 39806 Summary: Default checkout, hold and return policy should have a set and expiration date Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: System Administration Assignee: koha-bugs(a)lists.koha-community.org Reporter: cbrannon(a)cdalibrary.org QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com It would be great if we could define when the checkout, hold and return policy goes into effect and if it should expire. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0