- Koha-bugs - lists.koha-community.org

[Bug 43261] New: Public biblio API ignores OpacSuppressionByIPRange
by bugzilla-daemon＠bugs.koha-community.org 10 Aug '26

10 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43261 Bug ID: 43261 Summary: Public biblio API ignores OpacSuppressionByIPRange Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: tomascohen(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Depends on: 43258 Target Milestone: --- GET /api/v1/public/biblios/:id checks OpacSuppression but does not check OpacSuppressionByIPRange. This means suppressed records are unconditionally hidden from the public API even for clients within the allowed IP range. Additionally, clients outside the IP range can still access suppressed records if they know the biblio_id, since the IP range check is missing entirely. Impact: information disclosure - suppressed bibliographic records (which may be suppressed for legal, privacy, or collection management reasons) are accessible via the public API regardless of IP restrictions. Affected endpoints: - GET /api/v1/public/biblios/:id (Koha::REST::V1::Biblios::get_public) Related: bug 43258 introduces Koha::IP and Koha::REST::Plugin::Restrictions which provide the fix mechanism. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43258 [Bug 43258] Add a centralized IP range matching helper -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 2

[Bug 43266] New: Missing information on circ restrictions after override
by bugzilla-daemon＠bugs.koha-community.org 10 Aug '26

10 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43266 Bug ID: 43266 Summary: Missing information on circ restrictions after override Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: bdaeuber(a)cityoffargo.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle(a)bywatersolutions.com Target Milestone: --- When checking out, if a staff person overrides a checkout and clicks "Remember for the session for this patron", then checks out an item with a different restriction, information about that checkout is missing from the confirm checkout box. The box only says "This patron can't check out this item per library circulation policy." but doesn't contain information that's usually there (especially how many of that item type the user has out). To recreate: 1. Create a circ rule for an item type with zero checkouts allowed. 2. In the defaul checkout, hold policy by patron category, set a patron category to have some number of checkouts (we'll say 2 for this example). 3. Check out 2 regular (non-restricted) items types to a patron of the same type you set up in step 2. 4. Check out a 3rd regular item type to that patron. When you override the checkout, click "Remember for the session for this patron" and then "Yes, check out" 5. Check out an item of the type you set up in step 1. 6. The popup that appears is missing information such as the item type, number of items of that type out, etc. Fairly frequently we'll get users who come in and drop off a large number of items, then go to check out more, causing them to exceed the total checkouts allowed. Normally we'll just override the checkouts, but if the user also has an item with no checkouts allowed (say a reference book), staff will get this confusing message without enough information to find the problem item. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 2

[Bug 40963] New: More clarity for Last returned by vs Last borrower on moredetail.pl
by bugzilla-daemon＠bugs.koha-community.org 10 Aug '26

10 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40963 Bug ID: 40963 Summary: More clarity for Last returned by vs Last borrower on moredetail.pl Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: lucas(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle(a)bywatersolutions.com On moredetail.pl there is both Last returned by and Last borrower. It would be good to change this display somewhat, after Bug 26993, to offer better clarity between the two. See this comment: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26993#c33 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 2

[Bug 28657] New: Expand branches.branchip to allow for multiple space separated ip ranges
by bugzilla-daemon＠bugs.koha-community.org 10 Aug '26

10 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28657 Bug ID: 28657 Summary: Expand branches.branchip to allow for multiple space separated ip ranges Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: System Administration Assignee: koha-bugs(a)lists.koha-community.org Reporter: michael.hafen(a)washk12.org QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com change branches.branchip to a mediumtext, and remove '*' from existing branchip settings. Change C4/Auth.pm from a regexp to using in_iprange() to check client address against branchip. (in_iprange() doesn't work with '*' in branchip.) Change in_iprange() to default to false (which is what the POD says it should do). Also, have it trim '*' in case someone adds some back later. Change note in admin/branches.tt under branchip field to reflect changes to branchip handling. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 57

[Bug 37384] New: 500 error when creating/editing patrons with mandatory patron attribute and field collapsed
by bugzilla-daemon＠bugs.koha-community.org 10 Aug '26

10 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37384 Bug ID: 37384 Summary: 500 error when creating/editing patrons with mandatory patron attribute and field collapsed Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Patrons Assignee: koha-bugs(a)lists.koha-community.org Reporter: lucas(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com To recreate: 1. Add a patron attribute and mark it as mandatory.2 2. Add 'Additional attributes and identifiers' to the CollapseFieldsPatronAddForm sys pref 3. Try to create a new patron or edit an existing one. 4. 500 error -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 3

[Bug 40095] New: It would be beneficial to send the page when calling intranet_js plugin hooks
by bugzilla-daemon＠bugs.koha-community.org 10 Aug '26

10 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40095 Bug ID: 40095 Summary: It would be beneficial to send the page when calling intranet_js plugin hooks Change sponsored?: --- Product: Koha Version: unspecified Hardware: PC OS: Linux Status: NEW Severity: enhancement Priority: P1 - high Component: Plugin architecture Assignee: koha-bugs(a)lists.koha-community.org Reporter: martin.renvoize(a)openfifth.co.uk We have the intranet_js plugin hook to allow adding javascript to all intranet pages.. it would be great to have the specific page the hook is called from get passed so we can optionally run code to generate and return the JS instead of returning it for all pages. -- You are receiving this mail because: You are the assignee for the bug.

1 15

[Bug 39142] New: Add debug permission to allow user to toggle JS and CSS customizations on/off
by bugzilla-daemon＠bugs.koha-community.org 10 Aug '26

10 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39142 Bug ID: 39142 Summary: Add debug permission to allow user to toggle JS and CSS customizations on/off Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Staff interface Assignee: koha-bugs(a)lists.koha-community.org Reporter: andrew(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Depends on: 14004 We all love bug 14004 and its fun tools for loading pages without JS or CSS from sysprefs. We'd like to extend that idea to toggles that would appear on every page to turn UserJS and UserCSS on and off. We'd tie those toggles to a new "debug" permission, so only users with that permission will be shown those toggles. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14004 [Bug 14004] Add ability to temporarily disable added CSS and Javascript in OPAC and interface -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 63

[Bug 43235] New: Update some serials pages to use grid layout for forms - Part 2
by bugzilla-daemon＠bugs.koha-community.org 10 Aug '26

10 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43235 Bug ID: 43235 Summary: Update some serials pages to use grid layout for forms - Part 2 Initiative type: --- Sponsorship Sponsored status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Templates Assignee: oleonard(a)myacpl.org Reporter: oleonard(a)myacpl.org QA Contact: testopia(a)bugs.koha-community.org CC: testopia(a)bugs.koha-community.org Depends on: 39780 Target Milestone: --- - serials/subscription-batchedit.tt - serials/subscription-frequencies.tt - serials/subscription-numberpatterns.tt Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39780 [Bug 39780] Update library groups form to use grid layout -- You are receiving this mail because: You are watching all bug changes.

1 2

[Bug 41017] New: Show if item is on hold even if OverduesBlockRenewing is on
by bugzilla-daemon＠bugs.koha-community.org 10 Aug '26

10 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41017 Bug ID: 41017 Summary: Show if item is on hold even if OverduesBlockRenewing is on Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: caroline.cyr-la-rose(a)inlibro.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle(a)bywatersolutions.com I've had a comment by a library that uses OverduesBlockRenewing as well as AllowRenewalLimitOverride (and AllowRenewalOnHoldOverride) that when the item is overdue, the fact that it's on hold is not displayed in the patron's checkouts. Their issue is that while they don't want patrons renewing overdue items from the OPAC, they sometimes override the renewal in the staff interface, but end up unknowingly renewing something that is on hold... To recreate in main: 1. Go to a patron's account and checkout with a past date to create an overdue checkout 2. Place a hold for the same item for another patron 3. View the first patron's checkouts --> In the "Renew" column, it says "On hold" 4. Enable AllowRenewalOnHoldOverride 5. Go back to the patron's checkouts --> The "Renew" column should still say "On hold" 6. Check the "Override renewal restrictions" box --> A check box appears in the "Renew" column, which still displays "On hold" nonetheless 7. Enable OverduesBlockRenewing ("block renewing for all the patron's items") (I think both blocks should work in this scenario, but the library has it set to all) 8. Enable AllowRenewalLimitOverride 9. Go back to the patron's checkouts --> The "Renew" column displays "Not allowed: overdue" (OK) No mention of on hold (NOT OK?) 10. Check the "Override renewal restrictions" box --> A check box appears in the "Renew" column (OK), still no mention of on hold (NOT OK?) The "On hold" mention should be displayed whether or not the item is overdue. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 39

[Bug 43263] New: Public biblio ratings API does not check OpacSuppression
by bugzilla-daemon＠bugs.koha-community.org 10 Aug '26

10 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43263 Bug ID: 43263 Summary: Public biblio ratings API does not check OpacSuppression Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: tomascohen(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Depends on: 43258 Target Milestone: --- POST /api/v1/public/biblios/:id/ratings (Koha::REST::V1::Biblios::set_rating) does not check whether the biblio is suppressed. A logged-in patron can rate a suppressed record if they know its biblio_id, confirming the existence of a record that should be hidden. Impact: information disclosure - the existence of suppressed bibliographic records can be confirmed via the public API (a successful rating confirms the record exists). Affected endpoints: - POST /api/v1/public/biblios/:id/ratings (Koha::REST::V1::Biblios::set_rating) Related: bug 43258 introduces Koha::IP and Koha::REST::Plugin::Restrictions which provide the fix mechanism. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43258 [Bug 43258] Add a centralized IP range matching helper -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0