- Koha-bugs - lists.koha-community.org

[Bug 42800] Potential XSS in shelf list in the erm module
by bugzilla-daemon＠bugs.koha-community.org 26 Aug '26

26 Aug '26

1 0

[Bug 13870] Add warnings about subscriptions and orders when deleting items
by bugzilla-daemon＠bugs.koha-community.org 26 Aug '26

26 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13870 --- Comment #35 from Thibaud Guillot (thibaud_g) <thibaud.guillot(a)biblibre.com> --- Created attachment 204206 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=204206&action=e… Bug 13870: (follow-up) tidy -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 13870] Add warnings about subscriptions and orders when deleting items
by bugzilla-daemon＠bugs.koha-community.org 26 Aug '26

26 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13870 --- Comment #34 from Thibaud Guillot (thibaud_g) <thibaud.guillot(a)biblibre.com> --- Created attachment 204205 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=204205&action=e… Bug 13870: (follow-up) Fix linked order/subscription warnings get_column() in scalar context returned a row count, not the real serialid/subscriptionid, and order/subscription data overwrote each other in the same item's hash entry. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 13870] Add warnings about subscriptions and orders when deleting items
by bugzilla-daemon＠bugs.koha-community.org 26 Aug '26

26 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13870 --- Comment #33 from Thibaud Guillot (thibaud_g) <thibaud.guillot(a)biblibre.com> --- Created attachment 204204 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=204204&action=e… Bug 13870: (follow-up) fix strings internationalisation -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 13870] Add warnings about subscriptions and orders when deleting items
by bugzilla-daemon＠bugs.koha-community.org 26 Aug '26

26 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13870 --- Comment #32 from Thibaud Guillot (thibaud_g) <thibaud.guillot(a)biblibre.com> --- Created attachment 204203 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=204203&action=e… Bug 13870: (follow-up) Link to relevent pages from batch results -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 13870] Add warnings about subscriptions and orders when deleting items
by bugzilla-daemon＠bugs.koha-community.org 26 Aug '26

26 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13870 Thibaud Guillot (thibaud_g) <thibaud.guillot(a)biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #186020|0 |1 is obsolete| | Attachment #186021|0 |1 is obsolete| | Attachment #186022|0 |1 is obsolete| | --- Comment #31 from Thibaud Guillot (thibaud_g) <thibaud.guillot(a)biblibre.com> --- Created attachment 204202 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=204202&action=e… Bug 13870: Add warn about linked order or/and subscription on batch item table When you try to manage/delete/edit items I added an info about linked order or/and linked subscription. Test plan : 1) Apply this patch 2) Restart_all 3) Be sure to have item with order or can concern by a subscription 4) On biblio record page click on Edit -> Manage items 5) See the yellow triangle next to the 'delete' action in 'actions' dropdown menu (with subscription id or ordernumber hover the symbol) 6) When you edit or delete items (batch mode) you can see two new columns about orders and subscriptions linked. Sponsored by: BibLibre -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 13870] Add warnings about subscriptions and orders when deleting items
by bugzilla-daemon＠bugs.koha-community.org 26 Aug '26

26 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13870 Thibaud Guillot (thibaud_g) <thibaud.guillot(a)biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Patch doesn't apply |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 31925] New: AutoCreateAuthorities needs to preserve subject heading thesaurus to not create duplicate authority records
by bugzilla-daemon＠bugs.koha-community.org 26 Aug '26

26 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31925 Bug ID: 31925 Summary: AutoCreateAuthorities needs to preserve subject heading thesaurus to not create duplicate authority records Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: MARC Authority data support Assignee: koha-bugs(a)lists.koha-community.org Reporter: phil(a)chetcolibrary.org QA Contact: testopia(a)bugs.koha-community.org CC: nick(a)bywatersolutions.com Depends on: 30280 Bug 30280 taught the linker that "650 _ 0 $aFeminism" and "650 _ 7 $aFeminism$2sao" are not the same heading, so a bib record containing the latter should not be linked to the authority record which matches the former. However, AutoCreateAuthorities just creates LCSH authority records from anything, no matter what the values of indicator 2 and subfield 2 are. As a result, if you have an LCSH authority record for a term, and you import/create a non-LCSH term in a bib record and save it, AutoCreateAuthorities will create a new duplicate LCSH authority record and link to that. Every single time, a new duplicate. Steps to reproduce: 1. Use ElasticSearch, since the patch for bug 30280 only expected to work there, and in fact broke linking on Zebra, bug 31924. 2. Enable the preferences AutoCreateAuthorities, AutoLinkBiblios, CatalogModuleRelink 3. Edit any bib record, add a 650 tag, set the second indicator to 7, type Feminism in subfield a and type sao in subfield 2. 4. Save the record, edit it again, note the authority record id in subfield 9 of the Feminism heading. 5. Edit any other bib record, add a 650 tag, set the second indicator to 7, type Feminism in subfield a and type sao in subfield 2. 6. Save the record, edit it again, note the authority record id in subfield 9 of the Feminism heading. The two authority record ids should be the same, since the headings are identical, but instead one will be linked to, say, 1708 and the next to 1709, an identical duplicate record. Rather than setting position 11 of field 008 in the authority record to "a" for LCSH, AutoCreateAuthorities should have set it to "z" for Other and put sao in subfield f of field 040 (and for non-7, non-0 values of indicator 2, it should be setting 008/11 to the correct letter for that indicator value). Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30280 [Bug 30280] Support authority records with common subject headings from different thesaurus -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 27

[Bug 42719] New: OAuth/OIDC login crashes with 500 when no CGISESSID cookie exists (IdP-initiated flow)
by bugzilla-daemon＠bugs.koha-community.org 26 Aug '26

26 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42719 Bug ID: 42719 Summary: OAuth/OIDC login crashes with 500 when no CGISESSID cookie exists (IdP-initiated flow) Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Authentication Assignee: koha-bugs(a)lists.koha-community.org Reporter: tomascohen(a)gmail.com QA Contact: martin.renvoize(a)openfifth.co.uk CC: dpavlin(a)rot13.org When a user initiates login from the IdP (e.g. clicking an app tile in Okta), they are redirected directly to Koha's /api/v1/oauth/login/{provider}/{interface} endpoint without ever visiting a Koha page first. Since no Koha page was visited, no session exists and no CGISESSID cookie is present. The code at Koha::REST::V1::OAuth::Client line 99 calls: $c->req->cookie('CGISESSID')->value This crashes with: Can't call method "value" on an undefined value The fix is to create a session on-the-fly when the initial OAuth request has no existing session cookie. This supports IdP-initiated SSO flows while preserving CSRF protection (the state parameter is still bound to the session via the browser's cookie jar). The same guard is needed on the callback branch's check_csrf call â if the cookie is missing on callback, redirect with an error instead of crashing. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 30

[Bug 42517] New: Allow option to set StrictHostKeyChecking=accept-new for SFTP
by bugzilla-daemon＠bugs.koha-community.org 26 Aug '26

26 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42517 Bug ID: 42517 Summary: Allow option to set StrictHostKeyChecking=accept-new for SFTP Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: lisette(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org SFTP keys have to be accepted on the command line level currently, it would be helpful if in the kohaconf we could set StrictHostKeyChecking=accept-new to streamline sftp setups, but still have it be controlled from the server side. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 22