- Koha-bugs - lists.koha-community.org

[Bug 42924] New: Restore default MaxAge for CSRF token
by bugzilla-daemon＠bugs.koha-community.org 28 Aug '26

28 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42924 Bug ID: 42924 Summary: Restore default MaxAge for CSRF token Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: dcook(a)prosentient.com.au QA Contact: testopia(a)bugs.koha-community.org Target Milestone: --- Bug 17110 lowered the default MaxAge for the CSRF token from 1 week to 8 hours, but that has led to increased usability problems for negligible security gains. I propose to restore the default which is closer to the per-session approach for CSRF tokens which tends to be the default in many web frameworks like Django. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 13

[Bug 36789] New: Transform a booking into checkout
by bugzilla-daemon＠bugs.koha-community.org 28 Aug '26

28 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36789 Bug ID: 36789 Summary: Transform a booking into checkout Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: thibaud.guillot(a)biblibre.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com Hello, Linked to the booking feeture you can now transform a booking into a checkout directly from the booking list view. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 86

[Bug 32748] New: Library limitations will cause data loss when editing items
by bugzilla-daemon＠bugs.koha-community.org 28 Aug '26

28 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32748 Bug ID: 32748 Summary: Library limitations will cause data loss when editing items Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Cataloging Assignee: koha-bugs(a)lists.koha-community.org Reporter: katrin.fischer(a)bsz-bw.de QA Contact: testopia(a)bugs.koha-community.org CC: m.de.rooy(a)rijksmuseum.nl Moving this from bug 31422 where another issue was fixed to a new bug report: The library limitations are used to limit down the selection in pull downs in several spots. If you are editing data from library B while logged in at library A, doing so might result in data loss as the value stored in the modified object might be missing from the drop downs your user sees. Example 1: Item values Itemtype: BK Books - limited to Centerville AV LOC: FIC Fiction - limited to Centerville Your user: logged in for Centerville * Edit an item and make sure it uses the itemtype Books and location Fiction. * Switch library to any but Centerville. * Edit item: Both item type and location drow downs will be empty. * Saving now will empty out itemtype (if not set mandatory) and location resulting in data loss. I initially thought that bug 20256 might help here, but it won't as there is a mismatch of one feature checking the login library and the other checking the home library of the staff patron. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 84

[Bug 41860] New: With zebra, authority search plugin gives no result in some cases
by bugzilla-daemon＠bugs.koha-community.org 28 Aug '26

28 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41860 Bug ID: 41860 Summary: With zebra, authority search plugin gives no result in some cases Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: MARC Authority data support Assignee: januszop(a)gmail.com Reporter: januszop(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Depends on: 41859 When using Zebra, authority search plugin gives no result when the search term was was auto completed and it contains subdivisions and the search is performed with 'Search all headings' or 'Search entire record'. To reproduce: 1. Have SearchEngine set to Zebra. 2. When cataloging, go to field 650 and use the authority plugin. 3. In 'Search all headings:' or 'Search entire record:' start typing 'Computer software' and choose any hint (with subdivision). Note that the operator has changed to 'is exactly'. Perform the search. You should get no results, despite of the existence of the record. You only get the results after changing the operator to 'contains'. This is because of the construction of Match and Any indexes in Zebra. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41859 [Bug 41859] Authority search autocomplete results not consistent with search results -- You are receiving this mail because: You are watching all bug changes.

1 11

[Bug 39637] New: Patron search generates URIs that are too long and can cause "HTTP 414 URI Too Long" errors
by bugzilla-daemon＠bugs.koha-community.org 28 Aug '26

28 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39637 Bug ID: 39637 Summary: Patron search generates URIs that are too long and can cause "HTTP 414 URI Too Long" errors Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Patrons Assignee: koha-bugs(a)lists.koha-community.org Reporter: julian.maurice(a)biblibre.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com Continuation of bug 31104 which did not solve the problem completely. Steps to reproduce: 1. Log in to staff interface 2. In the top search bar, select "Patrons search" and type "a b c d e f g h i j k l m" and submit the form 3. The patrons table should fail to load with a message like this: "Something went wrong when loading the table. 414: Request-URI Too Long.". If the table loads successfully, try adding a few more letters (separated by space) to the search. Another error that can happen is a 5XX error caused by the length of Link headers. Here is the (decoded) URL generated for "a b c d e": http://koha-dev-main/api/v1/patrons?_page=1&_per_page=20&q=[{"-and":[[{"me.firstname":{"like":"a%"}},{"me.preferred_name":{"like":"a%"}},{"me.middle_name":{"like":"a%"}},{"me.surname":{"like":"a%"}},{"me.othernames":{"like":"a%"}},{"me.cardnumber":{"like":"a%"}},{"me.userid":{"like":"a%"}}],[{"me.firstname":{"like":"b%"}},{"me.preferred_name":{"like":"b%"}},{"me.middle_name":{"like":"b%"}},{"me.surname":{"like":"b%"}},{"me.othernames":{"like":"b%"}},{"me.cardnumber":{"like":"b%"}},{"me.userid":{"like":"b%"}}],[{"me.firstname":{"like":"c%"}},{"me.preferred_name":{"like":"c%"}},{"me.middle_name":{"like":"c%"}},{"me.surname":{"like":"c%"}},{"me.othernames":{"like":"c%"}},{"me.cardnumber":{"like":"c%"}},{"me.userid":{"like":"c%"}}],[{"me.firstname":{"like":"d%"}},{"me.preferred_name":{"like":"d%"}},{"me.middle_name":{"like":"d%"}},{"me.surname":{"like":"d%"}},{"me.othernames":{"like":"d%"}},{"me.cardnumber":{"like":"d%"}},{"me.userid":{"like":"d%"}}],[{"me.firstname":{"like":"e%"}},{"me.preferred_name":{"like":"e%"}},{"me.middle_name":{"like":"e%"}},{"me.surname":{"like":"e%"}},{"me.othernames":{"like":"e%"}},{"me.cardnumber":{"like":"e%"}},{"me.userid":{"like":"e%"}}]]},{"-or":[{"me.firstname":{"like":"a+b+c+d+e%"}},{"me.preferred_name":{"like":"a+b+c+d+e%"}},{"me.middle_name":{"like":"a+b+c+d+e%"}},{"me.surname":{"like":"a+b+c+d+e%"}},{"me.othernames":{"like":"a+b+c+d+e%"}},{"me.cardnumber":{"like":"a+b+c+d+e%"}},{"me.userid":{"like":"a+b+c+d+e%"}}]},{"-and":[[{"extended_attributes.value":{"like":"a%"},"extended_attributes.code":[["Nickname","PAT_1"]]}],[{"extended_attributes.value":{"like":"b%"},"extended_attributes.code":[["Nickname","PAT_1"]]}],[{"extended_attributes.value":{"like":"c%"},"extended_attributes.code":[["Nickname","PAT_1"]]}],[{"extended_attributes.value":{"like":"d%"},"extended_attributes.code":[["Nickname","PAT_1"]]}],[{"extended_attributes.value":{"like":"e%"},"extended_attributes.code":[["Nickname","PAT_1"]]}]]}]&_match=contains&_order_by=+me.surname,+me.preferred_name,+me.firstname,+me.middle_name,+me.othernames,+me.street_number,+me.address,+me.address2,+me.city,+me.state,+me.postal_code,+me.country (Ignore the extended_attributes.* params that are not the main issue here, even though they contribute to the problem) If I'm counting correctly, for each word searched, the URL length is increased by (216 + 7 * <word length>) characters (before encoding, which also increases the URI length by a lot). For me, with Apache, the problem happens around 8k characters (after encoding). IMO it would be better to send only parameters like 'search', 'search_type' and 'search_field' to the API and translate this to DBIC dialect on the backend. This would make it a lot harder to reach the limit (and would make the URI far more readable, which is always nice :)) -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 52

[Bug 39589] New: Search returns 'No results found' despite existing matching records
by bugzilla-daemon＠bugs.koha-community.org 28 Aug '26

28 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39589 Bug ID: 39589 Summary: Search returns 'No results found' despite existing matching records Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: hammat.wele(a)inlibro.com QA Contact: testopia(a)bugs.koha-community.org This issue occurs when the records on the first page of results are not displayed. The message "No results found" is shown, and it is not possible to access records on other pages. To test 1. Set the following system preferences: OPACnumSearchResults to 5 OpacHiddenItemsHidesRecord to Hide OpacHiddenItems to withdrawn: [1] 2. Create 6 bibliographic records with the following titles: "notice test 1" "notice test 2" "notice test 3" "notice test 4" "notice test 5" "notice test 6" 3. For the first 5 records, add an item with Withdrawn status. 4. For "notice test 6", add an item with Available status. 5. In the OPAC interface, search for "notice test". ---> The message "No results found!" appears, and "notice test 6" is not visible. -- You are receiving this mail because: You are watching all bug changes.

1 64

[Bug 30233] [CVE-2026-19780][ZDI-CAN-29165] Remote code execution in user-supplied regex
by bugzilla-daemon＠bugs.koha-community.org 28 Aug '26

28 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30233 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|[ZDI-CAN-29165] Remote code |[CVE-2026-19780][ZDI-CAN-29 |execution in user-supplied |165] Remote code execution |regex |in user-supplied regex --- Comment #158 from David Cook <dcook(a)prosentient.com.au> --- (In reply to ZDI Disclosures Trendmicro from comment #157) > Hello, > > Please find the following assigned CVE: CVE-2026-19780. Would you please > provide us with the fix link? > > > > Thanks, > ZDI Thanks for sharing that. I don't know what we'd use for a fix link per se, since the fix is spread across a number of patches listed in the Attachments section, but you can link to https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30233 and mention the fix is included in these versions (found above in "Version(s) released in:"): 26.11.00,26.05.02,25.11.07,25.05.13,24.11.18 Does that work for you? Thanks again for your work on this one! -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 43391] Add POD to all private subroutines/methods
by bugzilla-daemon＠bugs.koha-community.org 28 Aug '26

28 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43391 --- Comment #14 from David Cook <dcook(a)prosentient.com.au> --- (In reply to David Cook from comment #13) > Hmm I don't know about this as a solution... surely we don't want to be > adding POD for private functions? But then I see at https://gitlab.com/koha-community/qa-test-tools/-/work_items/103#note_31678… that Tomas thinks there should be POD for internal methods... I'll comment there because I don't understand why he would say that... -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 43391] Add POD to all private subroutines/methods
by bugzilla-daemon＠bugs.koha-community.org 28 Aug '26

28 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43391 --- Comment #13 from David Cook <dcook(a)prosentient.com.au> --- Hmm I don't know about this as a solution... surely we don't want to be adding POD for private functions? -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 43400] New: Add granularity to AllowHoldCheckoutOverride
by bugzilla-daemon＠bugs.koha-community.org 27 Aug '26

27 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43400 Bug ID: 43400 Summary: Add granularity to AllowHoldCheckoutOverride Initiative type: --- Sponsorship --- status: Product: Koha Version: 26.05 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: System Administration Assignee: koha-bugs(a)lists.koha-community.org Reporter: sbrown(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Depends on: 23909 Target Milestone: --- With the updates to AllowItemsOnHoldCheckoutSIP and AllowItemsOnHoldCheckoutSCO from bug 23909, administrators can now choose whether patrons can check out items with pending holds, or pending *and* waiting holds, or neither via SIP and SCO. However, the new AllowHoldCheckoutOverride system preference only has options for 'Allow' and 'Don't allow' without any distinction between allowing override of pending holds vs. waiting holds. This means that there is less flexibility in policy for staff who are checking items out to patrons than for patrons who check out via SIP and SCO. It would be helpful if AllowHoldCheckoutOverride had the same options for *types* of holds that can be overridden that now exist for AllowItemsOnHoldCheckoutSIP and AllowItemsOnHoldCheckoutSCO so that policies can be aligned no matter how patrons are checking out items. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23909 [Bug 23909] SCO allows to check out items with Waiting state if AllowItemsOnHoldCheckoutSCO -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0