- Koha-bugs - lists.koha-community.org

[Bug 37323] Remote-Code-Execution (RCE) in picture-upload.pl
by bugzilla-daemon＠bugs.koha-community.org 22 Aug '24

22 Aug '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37323 Katrin Fischer <katrin.fischer(a)bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldstable |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 37323] Remote-Code-Execution (RCE) in picture-upload.pl
by bugzilla-daemon＠bugs.koha-community.org 22 Aug '24

22 Aug '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37323 Katrin Fischer <katrin.fischer(a)bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Pushed to oldstable -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 37323] Remote-Code-Execution (RCE) in picture-upload.pl
by bugzilla-daemon＠bugs.koha-community.org 22 Aug '24

22 Aug '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37323 Katrin Fischer <katrin.fischer(a)bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Pushed to stable -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 37323] Remote-Code-Execution (RCE) in picture-upload.pl
by bugzilla-daemon＠bugs.koha-community.org 22 Aug '24

22 Aug '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37323 Katrin Fischer <katrin.fischer(a)bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|unspecified |Main Product|Koha security |Koha Group|Koha security | CC| |gmcharlt(a)gmail.com, | |kyle.m.hall(a)gmail.com Component|Koha |Patrons QA Contact| |testopia(a)bugs.koha-communit | |y.org --- Comment #36 from Katrin Fischer <katrin.fischer(a)bsz-bw.de> --- I've filed this as a follow-up bug: Bug 37712 - Switch picture-upload.pl to use Koha::Uploader -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 37712] New: Switch picture-upload.pl to use Koha::Uploader
by bugzilla-daemon＠bugs.koha-community.org 22 Aug '24

22 Aug '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37712 Bug ID: 37712 Summary: Switch picture-upload.pl to use Koha::Uploader Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: katrin.fischer(a)bsz-bw.de QA Contact: testopia(a)bugs.koha-community.org This came up in discusson on bug 37323. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 37706] New: Date filter not used in circulation report
by bugzilla-daemon＠bugs.koha-community.org 22 Aug '24

22 Aug '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37706 Bug ID: 37706 Summary: Date filter not used in circulation report Change sponsored?: --- Product: Koha Version: 23.11 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Reports Assignee: koha-bugs(a)lists.koha-community.org Reporter: andreas.jonsson(a)kreablo.se QA Contact: testopia(a)bugs.koha-community.org I noticed that the cirulation report was putting a significant load on the system so I added some debug logging to reports/issues_stats.pl to see what was going on: use Data::Dumper; warn Dumper([$line, $column, $podsp, $type, $daysel, $monthsel, $calc, \@filters, $attribute_filters]); my $results = calculate( $line, $column, $podsp, $type, $daysel, $monthsel, $calc, \@filters, $attribute_filters); and: warn "strsth: $strsth"; my $sth = $dbh->prepare($strsth); and: warn "strsth2: $strsth2"; my $sth2 = $dbh->prepare($strsth2); As you can see a filter was selected for the date period: 2024/08/22 08:02:52] [WARN] $VAR1 = [ 'branch', 'itemtype', '', 'issue', '', '', '1', [ '2024-08-21', '2024-08-21', ... We get a warnings because the date validation tries to numerically compare the date strings (which will cause the validation to always succeed even when selecting a start date greater than the end date): [2024/08/22 08:02:52] [WARN] Argument "2024-08-21" isn't numeric in numeric lt (<) at /usr/share/koha/intranet/cgi-bin/reports/issues_stats.pl line 216. [2024/08/22 08:02:52] [WARN] Argument "2024-08-21" isn't numeric in numeric lt (<) at /usr/share/koha/intranet/cgi-bin/reports/issues_stats.pl line 216. But neither sql queries refer to the selected date period: [2024/08/22 08:02:52] [WARN] strsth: SELECT distinctrow branch FROM statistics LEFT JOIN borrowers ON (statistics.borrowernumber = borrowers.borrowernumber) WHERE branch IS NOT NULL AND branch != '' AND branch LIKE ? group by branch order by branch at /usr/share/koha/intranet/cgi-bin/reports/issues_stats.pl line 327. [2024/08/22 08:03:28] [WARN] strsth2: SELECT distinctrow itemtype FROM statistics LEFT JOIN borrowers ON (statistics.borrowernumber = borrowers.borrowernumber) WHERE itemtype IS NOT NULL AND itemtype != '' group by itemtype order by itemtype at /usr/share/koha/intranet/cgi-bin/reports/issues_stats.pl line 418. So, the date filter is not actually used (other than for claiming that it was used in the generated report). -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 1

[Bug 37704] New: Custom authorized values do not appear in a selector in Advanced Editor
by bugzilla-daemon＠bugs.koha-community.org 22 Aug '24

22 Aug '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37704 Bug ID: 37704 Summary: Custom authorized values do not appear in a selector in Advanced Editor Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Cataloging Assignee: koha-bugs(a)lists.koha-community.org Reporter: esther.melander(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: m.de.rooy(a)rijksmuseum.nl To see with existing Koha Authorized Values: 1. Edit the Default framework and add the authorized value RELTERMS to tag 100 $e. 2. Open a blank record in the Basic Editor and see the authorized values in the 100 $e. 3. Open a blank record in the Advanced Editor and key in 100 _ _ $e See the authorized values box appear. To replicate with custom authorized values: 1. Create an Authorized Value category called CANDY. Add some values like Reeses, Lollipop, etc. 2. Edit the default framework and modify the authorized value for 100 $e to CANDY. 3. Open a blank record in the Basic Editor. See the CANDY authorized values in 100 $e. 3. Open a blank record in the Advanced Editor and key in 100 _ _ $e The authorized values box does not appear. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 6

[Bug 14250] Can generate discharge for patrons with fines
by bugzilla-daemon＠bugs.koha-community.org 22 Aug '24

22 Aug '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14250 Roman Dolny <roman.dolny(a)jezuici.pl> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #170581|0 |1 is obsolete| | --- Comment #14 from Roman Dolny <roman.dolny(a)jezuici.pl> --- Created attachment 170607 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=170607&action=e… Bug 14250: Patron with fines cannot be discharged anymore TEST PLAN: 1 - In the intranet add fines to a client and ensure they have no checkout 2 - Set syspref useDischarge to 'Allow' 3 - On client profile click on "Discharge", see it is possible 4 - On the opac, go to the tab "Ask for discharge", see it is possible 5 - Apply patch 6 - Click on the button "Ask for discharge" -> it will not be possible and you will be propperly messaged 7 - Return to the tab "Ask for a discharge", there will be no button anymore 8 - On the intranet page, there will be no button anymore 9 - Check out a book 10 - Repeat 7 and 8 and see the message include issue with checkout 11 - Remove fine and repeat 7 & 8 Signed-off-by: Roman Dolny <roman.dolny(a)jezuici.pl> -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14250] Can generate discharge for patrons with fines
by bugzilla-daemon＠bugs.koha-community.org 22 Aug '24

22 Aug '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14250 Roman Dolny <roman.dolny(a)jezuici.pl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 35402] Update the OPAC and staff interface to Bootstrap 5
by bugzilla-daemon＠bugs.koha-community.org 22 Aug '24

22 Aug '24

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35402 Martin Renvoize <martin.renvoize(a)ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA --- Comment #9 from Martin Renvoize <martin.renvoize(a)ptfs-europe.com> --- I'm going to be bold and mark this PQA. I've done a fair bit of testing and we've iterated a fair bit. I'm never going to spot everything and I don't think we will until it's out there. But I do think it's ready for the masses, the developer masses that is. So lets go for it (Also agreed on chat.koha-community.org with Owen and Katrin that this is the best way forward at this stage.) Great work guys.. PQA -- You are receiving this mail because: You are watching all bug changes.

1 0