- Koha-bugs - lists.koha-community.org

[Bug 42847] SIP authentication ignored after initial successful connection
by bugzilla-daemon＠bugs.koha-community.org 11 Aug '26

11 Aug '26

1 0

[Bug 42866] SQL Injection in Koha/AdditionalContents.pm search_for_display via the patron lang value (stored / second-order, executed on issue-slip print, unvalidated string context, no placeholder)
by bugzilla-daemon＠bugs.koha-community.org 11 Aug '26

11 Aug '26

1 0

[Bug 43019] OPAC pages limited to library are readable by unauthenticated users
by bugzilla-daemon＠bugs.koha-community.org 11 Aug '26

11 Aug '26

1 0

[Bug 30233] [ZDI-CAN-29165] Remote code execution in user-supplied regex
by bugzilla-daemon＠bugs.koha-community.org 11 Aug '26

11 Aug '26

1 0

[Bug 32142] New: Add HoldFeeMode option "if all items are checked out OR the record has at least one hold already"
by bugzilla-daemon＠bugs.koha-community.org 11 Aug '26

11 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32142 Bug ID: 32142 Summary: Add HoldFeeMode option "if all items are checked out OR the record has at least one hold already" Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Hold requests Assignee: koha-bugs(a)lists.koha-community.org Reporter: aleisha(a)catalyst.net.nz QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Relates to Bug 31963. There is an option for the HoldFeeMode system preference "only if all items are checked out and the record has at least one hold already", except it behaved more like "if all items are checked out OR the record has at least one hold already". Bug 31963 fixed this so that the behaviour better matches the description i.e. it says 'and' so that implies BOTH conditions must be met. However we now need an option so that the behaviour from before isn't lost, behaviour like "if all items are checked out or the record has at least one hold already" -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 48

[Bug 43243] New: Remove pdfmake from DataTables
by bugzilla-daemon＠bugs.koha-community.org 11 Aug '26

11 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43243 Bug ID: 43243 Summary: Remove pdfmake from DataTables Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Templates Assignee: oleonard(a)myacpl.org Reporter: dcook(a)prosentient.com.au QA Contact: testopia(a)bugs.koha-community.org Target Milestone: --- For a long time, the bundled datatables library has included "pdfmake" which is required for the "PDF HTML5 export button". But... we don't actually use the "PDF HTML5 export button" in Koha. I also got some hits on ClamAV for : /usr/share/koha/intranet/htdocs/intranet-tmpl/lib/datatables/datatables.min.js: Html.Phishing.SVGDynamicFunction-10060409-0 FOUND /usr/share/koha/intranet/htdocs/intranet-tmpl/lib/datatables/datatables.js: Html.Phishing.SVGDynamicFunction-10060409-0 FOUND A brief look for SVG shows the "pdfmake" library and if you clone that repo and checkout 0.2.7 which is the version we're using... and then run clamav against that you'll get the same hit. However, it looks like it's a false positive. I prove this in my report to pdfmake: https://github.com/bpampuch/pdfmake/issues/2942 So... not a real security problem but it will probably start popping up on people scanning Koha. It does look like the signature doesn't match against the "pdfmake" master branch, so we could look at upgrading the DataTables and its pdfmake library, or we could remove it (although we'll probably need to upgrade our DataTables due to how the DataTables bundler works) -- You are receiving this mail because: You are watching all bug changes.

1 7

[Bug 42937] New: Not testing 'strict' for perl?
by bugzilla-daemon＠bugs.koha-community.org 11 Aug '26

11 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42937 Bug ID: 42937 Summary: Not testing 'strict' for perl? Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Test Suite Assignee: jonathan.druart(a)gmail.com Reporter: jonathan.druart(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Target Milestone: --- t/db_dependent/00-strict.t 22 $Test::Strict::TEST_STRICT = 0; 0? -- You are receiving this mail because: You are watching all bug changes.

1 22

[Bug 42349] New: Incorrect filter by recalls
by bugzilla-daemon＠bugs.koha-community.org 11 Aug '26

11 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42349 Bug ID: 42349 Summary: Incorrect filter by recalls Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Staff interface Assignee: jonathan.druart(a)gmail.com Reporter: jonathan.druart(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Depends on: 37334 On the holdings table the filter by status=recalls is not working correctly. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37334 [Bug 37334] Cannot filter holdings table by status -- You are receiving this mail because: You are watching all bug changes.

1 20

[Bug 42066] New: CSRF-token sometimes missing from pages
by bugzilla-daemon＠bugs.koha-community.org 11 Aug '26

11 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42066 Bug ID: 42066 Summary: CSRF-token sometimes missing from pages Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: magnus(a)libriotech.no QA Contact: testopia(a)bugs.koha-community.org To reproduce in KTD: - In your console, keep an eye on the logs: $ sudo tail -f /var/log/koha/kohadev/plack*.log - Open the SCO main page (http://localhost:8080/cgi-bin/koha/sco/sco-main.pl) in your browser, but do not do anything there - Remove the path from the URL, in the address bar of your browser, so you just have http://localhost:8080/, and press enter - Use Ctrl+u or "developer tools" to view the source of the front page, search for "csrf" and verify the elements that should contain the csrf token are empty: <meta name="csrf-token" content="" /> <input type="hidden" name="csrf_token" value="" /> - Log in an verify you get an error like this: Error 403 This message can have the following reason(s): An unexpected error occurred while processing your request. - Check the logs and verify you have an error like this: ==> /var/log/koha/kohadev/plack-opac-error.log <== [2026/03/11 08:12:41] [WARN] Programming error - No CSRF token passed for POST http://localhost:8080/opac/opac-main.pl (referer: http://localhost:8080/) at /kohadevbox/koha/Koha/Middleware/CSRF.pm line 97. Moving from SCO to the main page like this is probably not something that happens too often, but perhaps there is some underlying problem that can also affect other parts of Koha? -- You are receiving this mail because: You are watching all bug changes.

1 24

[Bug 35948] New: cleanup_database.pl should remove not only finished background jobs
by bugzilla-daemon＠bugs.koha-community.org 11 Aug '26

11 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35948 Bug ID: 35948 Summary: cleanup_database.pl should remove not only finished background jobs Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Command-line Utilities Assignee: koha-bugs(a)lists.koha-community.org Reporter: fridolin.somers(a)biblibre.com QA Contact: testopia(a)bugs.koha-community.org CC: robin(a)catalyst.net.nz Bug 31969 changed cleanup_database.pl so it removes only finished background jobs. But old background jobs with other statuses will never be removed. I see no use to that -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 25