- Koha-bugs - lists.koha-community.org

[Bug 41834] New: Remove systempreferences's options, explanation and type DB values
by bugzilla-daemon＠bugs.koha-community.org 19 Aug '26

19 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41834 Bug ID: 41834 Summary: Remove systempreferences's options, explanation and type DB values Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: jonathan.druart(a)gmail.com Reporter: jonathan.druart(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Depends on: 41833 We currently have to set options, explanation and type in sysprefs.sql and the atomic/dbrev files. However we (almost) never use them, we rely on the values in the yml files. We could remove them and don't require them when when add new sysprefs. It will avoid the mess we currently have (mismatch between new and updated installations, see bug 41682 and bug 41800). Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41833 [Bug 41833] Use YML description for syspref's search -- You are receiving this mail because: You are watching all bug changes.

1 64

[Bug 23756] New: Appendix for workflows
by bugzilla-daemon＠bugs.koha-community.org 19 Aug '26

19 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23756 Bug ID: 23756 Summary: Appendix for workflows Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Documentation Assignee: koha-bugs(a)lists.koha-community.org Reporter: cbrannon(a)cdalibrary.org QA Contact: testopia(a)bugs.koha-community.org Wondering if the documentation should include workflow examples for different tasks. I know how different each library can be with their workflows, but workflows seem to be a common topic, and there are multiple ways to approach different tasks. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 8

[Bug 43338] New: Holds table displays "A patron from library undefined" for patrons with no cardnumber
by bugzilla-daemon＠bugs.koha-community.org 19 Aug '26

19 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43338 Bug ID: 43338 Summary: Holds table displays "A patron from library undefined" for patrons with no cardnumber Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Hold requests Assignee: koha-bugs(a)lists.koha-community.org Reporter: lari.taskula(a)hypernova.fi QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, lisette(a)bywatersolutions.com, tomascohen(a)gmail.com Target Milestone: --- If a patron has no cardnumber, "Patron" column of the holds table says "A patron from library undefined" even if HidePatronName is set to "Show". To reproduce: 1. Set system preference "HidePatronName" to "Show" 2. Place a hold on a record to a patron with no cardnumber 3. Navigate to "Holds" tab of the record (/cgi-bin/koha/reserve/request.pl?biblionumber=1234) 4. Observe "A patron from library undefined" under column "Patron" Cardnumber should not be a requirement to display patron details in the holds table. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 1

[Bug 43335] New: Note field in Accounting is inconsistently typed
by bugzilla-daemon＠bugs.koha-community.org 19 Aug '26

19 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43335 Bug ID: 43335 Summary: Note field in Accounting is inconsistently typed Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: trivial Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: dcook(a)prosentient.com.au QA Contact: testopia(a)bugs.koha-community.org Target Milestone: --- On the patron's Accounting page, in the "Create manual invoice", "Create manual credit", and "Make a payment" tabs the "Note" is an input box but in "Transactions" it's a textbox which can include new lines which are converted to <br>. This is a weird inconsistency. Do we want them all to be textboxes or them all to be text inputs? -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 1

[Bug 42471] [CVE-2026-41921] /cgi-bin/koha/suggestion/suggestion.pl Multiple Parameters Stored Cross-Site Scripting
by bugzilla-daemon＠bugs.koha-community.org 19 Aug '26

19 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42471 --- Comment #32 from David Cook <dcook(a)prosentient.com.au> --- (In reply to wsparks from comment #31) > The VulnCheck CVE Numbering Authority (CNA) will be publishing > CVE-2026-41921 to identify this vulnerability. Thanks. I've updated the report title to include it. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42471] [CVE-2026-41921] /cgi-bin/koha/suggestion/suggestion.pl Multiple Parameters Stored Cross-Site Scripting
by bugzilla-daemon＠bugs.koha-community.org 19 Aug '26

19 Aug '26

1 0

[Bug 8127] Most-circulated items report doesn't work when limited by library
by bugzilla-daemon＠bugs.koha-community.org 19 Aug '26

19 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=8127 Wainui Witika-Park <wainuiwitikapark(a)catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|26.11.00,26.05.03 |26.11.00,26.05.03,25.05.14 released in| | CC| |wainuiwitikapark(a)catalyst.n | |et.nz --- Comment #15 from Wainui Witika-Park <wainuiwitikapark(a)catalyst.net.nz> --- Applied to 25.05 for 25.05.14 (needed for 42736) -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42471] /cgi-bin/koha/suggestion/suggestion.pl Multiple Parameters Stored Cross-Site Scripting
by bugzilla-daemon＠bugs.koha-community.org 18 Aug '26

18 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42471 --- Comment #31 from wsparks(a)vulncheck.com --- The VulnCheck CVE Numbering Authority (CNA) will be publishing CVE-2026-41921 to identify this vulnerability. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 36369] New: Make APIClient be more useful
by bugzilla-daemon＠bugs.koha-community.org 18 Aug '26

18 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36369 Bug ID: 36369 Summary: Make APIClient be more useful Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: tomascohen(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org I file this report for discussion. In my opinion, there's too much duplicated code on the API client libraries. And the APIClient "class" is just a shortcut to avoid instantiating the module-specific API clients: ```javascript import ERMAPIClient from "./erm-api-client"; ... export const APIClient = { erm: new ERMAPIClient(), ``` Then used everywhere like this: ```javascript import { APIClient } from "../../fetch/api-client.js" ... const client = APIClient.erm await client.agreements.count().then( ``` IMHO, we need a real APIClient class that would implement generic methods like: ```javascript create: params => this.post({ endpoint: params.endpoint ? params.endpoint : "/", body: params.resource, headers: params.headers }), ... getAll: params => this.get({ endpoint: params.endpoint ? params.endpoint : "/", params.query, headers: params.headers, }), ... count: params => this.count({ endpoint: params.endpoint ? params.endpoint : "/", "?" + new URLSearchParams({ _page: 1, _per_page: 1, ...(params.query && { q: JSON.stringify(params.query) }), }), }), ``` and the API Client classes (like ERMAPIClient) should inherit from it, somehow. For doing so, we will face another design roadblock: While I uderstand that ERMAPIClient is a single place to have all the ERM module-needed API actions, it still feels weird from an OOP perspective how things are organized. I feel like we should have individual classes, like: ```javascript export RecordSourcesAPIClient extends APIClient ``` and then have a new type of class along this lines: ```javascript import CitiesAPIClient from "./cities-api-client"; import RecordSourcesAPIClient from "./record-sources-api-client"; ... export const AdminAPIClient = { cities: new CitiesAPIClient(), record_sources: new RecordSourcesAPIClient(), ... }; ``` this way, we will avoid repeating ourselves (less bugs!) and the code is (I expect) more reusable. I also think the `embed` handling should just be a list for the different methods, like: embed: [ 'patron', 'patron.category' ] and generically handled by APIClient. No need to build the headers manually everywhere. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 59

[Bug 42811] New: Migrate x-koha-embed headers to embed keyword in API clients
by bugzilla-daemon＠bugs.koha-community.org 18 Aug '26

18 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42811 Bug ID: 42811 Summary: Migrate x-koha-embed headers to embed keyword in API clients Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: REST API Assignee: koha-bugs(a)lists.koha-community.org Reporter: tomascohen(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org CC: tomascohen(a)gmail.com Depends on: 36369 Target Milestone: --- Bug 36369 introduced KohaApiClient with a _resolveEmbed() method that translates an embed parameter into the x-koha-embed header automatically. Several API client files still use the old pattern of manually setting the header: headers: { "x-koha-embed": "field1,field2" } These should be migrated to: embed: ["field1", "field2"] Files to migrate: - acquisition-api-client.js - authorised-values-api-client.js - checkout-api-client.js - erm-api-client.js - ill-api-client.js - preservation-api-client.js - sip2-api-client.js Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36369 [Bug 36369] Make APIClient be more useful -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 1