- Koha-bugs - lists.koha-community.org

[Bug 42361] [CVE-2026-6428] SQL Injection in reports/catalogue_out.pl via Filter parameter (error-based, triggered when Criteria matches /branchcode/)
by bugzilla-daemon＠bugs.koha-community.org 15 Jun '26

15 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42361 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|SQL Injection in |[CVE-2026-6428] SQL |reports/catalogue_out.pl |Injection in |via Filter parameter |reports/catalogue_out.pl |(error-based, triggered |via Filter parameter |when Criteria matches |(error-based, triggered |/branchcode/) |when Criteria matches | |/branchcode/) --- Comment #28 from David Cook <dcook(a)prosentient.com.au> --- (In reply to Sanjarbiy from comment #27) > CVE-2026-6428 has been assigned and published for this issue via > TuranSecurity (a CVE Numbering Authority). Public record: > https://www.cve.org/CVERecord?id=CVE-2026-6428 . Thanks to David and > Jonathan for the fix and review. Thanks, Sanjar, for reporting the issue and respecting our process. I recognise the name Turan Security. We've had other reports from employees/former employees from there. Very happy to keep working with you on the issues you report. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 32791] New: Log4perl configuration files need a tool for updating on package upgrade
by bugzilla-daemon＠bugs.koha-community.org 15 Jun '26

15 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32791 Bug ID: 32791 Summary: Log4perl configuration files need a tool for updating on package upgrade Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: dcook(a)prosentient.com.au QA Contact: testopia(a)bugs.koha-community.org Typically, we update existing log4perl.conf files using debian/koha-common.postinst but it's making that file grow way too much and it's difficult to test. Instead, let's provide a CLI tool that we can more easily test and update without touching debian/koha-common.postinst directly. It should hopefully simplify maintenance. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 25

[Bug 42577] New: Gettext.js incorrectly located and tidied
by bugzilla-daemon＠bugs.koha-community.org 15 Jun '26

15 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42577 Bug ID: 42577 Summary: Gettext.js incorrectly located and tidied Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: trivial Priority: P5 - low Component: Templates Assignee: oleonard(a)myacpl.org Reporter: dcook(a)prosentient.com.au QA Contact: testopia(a)bugs.koha-community.org If you look at opac-tmpl/bootstrap/js/Gettext.js or its intranet-tmpl equivalent, you'll notice that it's actually a third-party script and not a Koha script, so it should be in the "lib" folder and the license for it should be added to about.tt We've also tidied the file because it wasn't in "lib"... so we might want to undo that. -- You are receiving this mail because: You are watching all bug changes.

1 4

[Bug 32489] New: Add check out date, number of renewals, numbers of overdue days in list of overdues
by bugzilla-daemon＠bugs.koha-community.org 14 Jun '26

14 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32489 Bug ID: 32489 Summary: Add check out date, number of renewals, numbers of overdue days in list of overdues Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: mathsabypro(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com In circ/overdue.pl it could be useful to add for each line - the check out date - the number of renewals - the number of overdue days (today - due date) -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 5

[Bug 14587] Acq: Make it possible to edit asort1 and asort2 values on receive
by bugzilla-daemon＠bugs.koha-community.org 14 Jun '26

14 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14587 --- Comment #3 from Mathieu Saby <mathsabypro(a)gmail.com> --- Oh yes! But the label of the link could be edited to be more explicit. It is "edit fund". Maybe it could be "edit fund or statistical codes" ? Same remark for the title of the popup ("Update received fund") -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 10198] Add the ability to import and export authorized values
by bugzilla-daemon＠bugs.koha-community.org 14 Jun '26

14 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10198 --- Comment #9 from Mathieu Saby <mathsabypro(a)gmail.com> --- Thank you for this proposal! This seems to address the core of the requirement, but each value code can be linked to a description, an OPAC description, an icon, and branch restrictions. Are you suggesting that we manage only the descriptions, or also the icons and branch restrictions? -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 42361] SQL Injection in reports/catalogue_out.pl via Filter parameter (error-based, triggered when Criteria matches /branchcode/)
by bugzilla-daemon＠bugs.koha-community.org 13 Jun '26

13 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42361 --- Comment #27 from Sanjarbiy <sanjarbiy11(a)gmail.com> --- CVE-2026-6428 has been assigned and published for this issue via TuranSecurity (a CVE Numbering Authority). Public record: https://www.cve.org/CVERecord?id=CVE-2026-6428 . Thanks to David and Jonathan for the fix and review. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 27105] New: Add checkout notes from staff client
by bugzilla-daemon＠bugs.koha-community.org 13 Jun '26

13 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27105 Bug ID: 27105 Summary: Add checkout notes from staff client Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: new feature Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: severine.queune(a)bulac.fr QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com AllowCheckoutNotes allows patrons to add notes for a specific checkout from OPAC. It could be useful we could have the same feature on Staff client. Librarians could add some useful informations for checking (annotated or highlighted text before the checkout, book already damaged, needs a new label after the return, etc.). A good feature to have less litigation with patrons when checking books with some problems ! -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 17

[Bug 10198] Add the ability to import and export authorized values
by bugzilla-daemon＠bugs.koha-community.org 13 Jun '26

13 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10198 Narcis Garcia <narcisgarcia(a)gilug.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC|narcisgarcia(a)gilug.org | -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 5388] Circulation of related/requiring items (like Book and CD sets)
by bugzilla-daemon＠bugs.koha-community.org 13 Jun '26

13 Jun '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5388 Mathieu Saby <mathsabypro(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mathsabypro(a)gmail.com --- Comment #3 from Mathieu Saby <mathsabypro(a)gmail.com> --- A colleague recently asked me how to handle easily the reservation of a book that comes with a CD, both of which are listed as separate items under the same record. I think that falls within the scope of this bug? I'm not sure bundles would be the best solution. I thought they were mainly for linking items from different records. In any case, we're not going to go to the trouble of creating bundles by hand just to group all the CDs with their accompanying booklets. I don't really understand the concept, but could "holding records" be a possible (though difficult to implement) solution in the future ? https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20447 -- You are receiving this mail because: You are watching all bug changes. You are the QA Contact for the bug.

1 0