- Koha-bugs - lists.koha-community.org

[Bug 14962] Temp Shelving Location / On Display Module
by bugzilla-daemon＠bugs.koha-community.org 15 Jun '26

15 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14962 Jake Deery <jake.deery(a)openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #199647|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14962] Temp Shelving Location / On Display Module
by bugzilla-daemon＠bugs.koha-community.org 15 Jun '26

15 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14962 Jake Deery <jake.deery(a)openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #199646|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14962] Temp Shelving Location / On Display Module
by bugzilla-daemon＠bugs.koha-community.org 15 Jun '26

15 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14962 Jake Deery <jake.deery(a)openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #199645|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14962] Temp Shelving Location / On Display Module
by bugzilla-daemon＠bugs.koha-community.org 15 Jun '26

15 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14962 Jake Deery <jake.deery(a)openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #199644|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14962] Temp Shelving Location / On Display Module
by bugzilla-daemon＠bugs.koha-community.org 15 Jun '26

15 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14962 Jake Deery <jake.deery(a)openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #199643|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 14962] Temp Shelving Location / On Display Module
by bugzilla-daemon＠bugs.koha-community.org 15 Jun '26

15 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14962 Jake Deery <jake.deery(a)openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #199642|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42845] New: Access to ILL requires parameters => 'manage_sysprefs'
by bugzilla-daemon＠bugs.koha-community.org 15 Jun '26

15 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42845 Bug ID: 42845 Summary: Access to ILL requires parameters => 'manage_sysprefs' Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: ILL Assignee: koha-bugs(a)lists.koha-community.org Reporter: nugged(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org CC: lisette(a)bywatersolutions.com, pedro.amorim(a)openfifth.co.uk, tomascohen(a)gmail.com Depends on: 37762 Target Milestone: --- The ILL Vue app reads `ILLModule` and `ILLPartnerCode` through the system preferences service when it starts. That service requires `parameters/manage_sysprefs`, so a staff user with ILL permissions but without system preference administration permissions cannot load the ILL module. Steps to reproduce: 1. Enable `ILLModule`. 2. Set `ILLPartnerCode` to an existing patron category used for ILL partners. 3. Create a staff user with ILL permissions, but without `parameters/manage_sysprefs`. 4. Log in with that staff user. 5. Go to the staff ILL module at `/cgi-bin/koha/ill/ill.pl`. Expected result: The ILL module loads for a staff user with ILL permissions. Actual result: The ILL module cannot load its runtime configuration because the system preferences service returns an authorization failure. Depending on the UI path, the user may see an error such as `Something went wrong when loading the table. 401: Unauthorized`, followed by JavaScript errors caused by missing configuration data. Technical note: This is the same class of issue as bug 33606 for ERM. The proposed patch adds a module-specific `/ill/config` endpoint protected by the `ill` permission. It returns only allow-listed, non-secret ILL configuration values needed by the ILL Vue app. It does not expose the generic system preferences API, and `/api/v1/sysprefs` remains restricted to `parameters/manage_sysprefs`. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37762 [Bug 37762] Expand ILL to allow for supplying agency/lending library workflows -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 4

[Bug 33606] New: Access to ERM requires parameters => 'manage_sysprefs'
by bugzilla-daemon＠bugs.koha-community.org 15 Jun '26

15 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33606 Bug ID: 33606 Summary: Access to ERM requires parameters => 'manage_sysprefs' Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: ERM Assignee: jonathan.druart+koha(a)gmail.com Reporter: jonathan.druart+koha(a)gmail.com CC: jonathan.druart+koha(a)gmail.com, jonathan.field(a)ptfs-europe.com, martin.renvoize(a)ptfs-europe.com, matt.blenkinsop(a)ptfs-europe.com, pedro.amorim(a)ptfs-europe.com Since bug 33408 we are fetching sysprefs from svc/config/systempreferences, but this script requires parameters => 'manage_sysprefs' -- You are receiving this mail because: You are watching all bug changes.

1 71

[Bug 42361] [CVE-2026-6428] SQL Injection in reports/catalogue_out.pl via Filter parameter (error-based, triggered when Criteria matches /branchcode/)
by bugzilla-daemon＠bugs.koha-community.org 15 Jun '26

15 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42361 --- Comment #30 from Sanjarbiy <sanjarbiy11(a)gmail.com> --- Thanks David, that means a lot. It has been a pleasure working with you and Jonathan, and I am glad the CVE record turned out well. Looking forward to continuing. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42361] [CVE-2026-6428] SQL Injection in reports/catalogue_out.pl via Filter parameter (error-based, triggered when Criteria matches /branchcode/)
by bugzilla-daemon＠bugs.koha-community.org 15 Jun '26

15 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42361 --- Comment #29 from David Cook <dcook(a)prosentient.com.au> --- (In reply to Sanjarbiy from comment #27) > CVE-2026-6428 has been assigned and published for this issue via > TuranSecurity (a CVE Numbering Authority). Public record: > https://www.cve.org/CVERecord?id=CVE-2026-6428 . Thanks to David and > Jonathan for the fix and review. I also meant to say good job on the CVE entry. I'm glad to see that it has a reference back here and covers the affected versions. -- You are receiving this mail because: You are watching all bug changes.

1 0