- Koha-bugs - lists.koha-community.org

[Bug 26102] Javascript injection in intranet search
by bugzilla-daemon＠bugs.koha-community.org 21 Feb '22

21 Feb '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26102 --- Comment #47 from Jonathan Druart <jonathan.druart+koha(a)gmail.com> --- Created attachment 130932 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=130932&action=e… Bug 26102: [19.11] Prevent XSS when To.json is used: authorities/authorities.tt Check that mandatory tags and subfields are correctly required when editing an authority record. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 26102] Javascript injection in intranet search
by bugzilla-daemon＠bugs.koha-community.org 21 Feb '22

21 Feb '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26102 --- Comment #46 from Jonathan Druart <jonathan.druart+koha(a)gmail.com> --- Created attachment 130931 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=130931&action=e… Bug 26102: [19.11] Prevent XSS when To.json is used: admin/preferences.tt Test that preference search term highlighting works correctly. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 26102] Javascript injection in intranet search
by bugzilla-daemon＠bugs.koha-community.org 21 Feb '22

21 Feb '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26102 Jonathan Druart <jonathan.druart+koha(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |30044 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30044 [Bug 30044] Z39.50/SRU search button broken by update to 19.11.25 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29840] New: opac-reserve explodes if invalid biblionumber is passed
by bugzilla-daemon＠bugs.koha-community.org 21 Feb '22

21 Feb '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29840 Bug ID: 29840 Summary: opac-reserve explodes if invalid biblionumber is passed Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: ASSIGNED Severity: normal Priority: P5 - low Component: OPAC Assignee: jonathan.druart+koha(a)gmail.com Reporter: jonathan.druart+koha(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org An error message should be displayed instead. Can't call method "holds" on an undefined value at /kohadevbox/koha/opac/opac-reserve.pl line 172 -- You are receiving this mail because: You are watching all bug changes.

1 13

[Bug 29838] New: No string interpolation when expected in t/db_dependent/ImportBatch.t
by bugzilla-daemon＠bugs.koha-community.org 21 Feb '22

21 Feb '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29838 Bug ID: 29838 Summary: No string interpolation when expected in t/db_dependent/ImportBatch.t Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: ASSIGNED Severity: minor Priority: P5 - low Component: Test Suite Assignee: jonathan.druart+koha(a)gmail.com Reporter: jonathan.druart+koha(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org -my $batch3_clean = $dbh->do('SELECT * FROM import_records WHERE import_batch_id = "$id_import_batch3"'); -- You are receiving this mail because: You are watching all bug changes.

1 13

[Bug 29646] New: opac-password-recovery crash on wrong borrower_number
by bugzilla-daemon＠bugs.koha-community.org 21 Feb '22

21 Feb '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29646 Bug ID: 29646 Summary: opac-password-recovery crash on wrong borrower_number Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: m.de.rooy(a)rijksmuseum.nl QA Contact: testopia(a)bugs.koha-community.org Seeing this in 20.11 but code in master has not changed: Can't call method "category" on an undefined value at /usr/share/koha/opac/opac-password-recovery.pl line 204 eval {...} at /usr/share/koha/opac/opac-password-recovery.pl line 2 CGI::Compile::ROOT::usr_share_koha_opac_opac_2dpassword_2drecovery_2epl::__ANON__('CGI::Compile=HASH(0x56477a9a9208)', '', '/usr/share/koha/opac/opac-password-recovery.pl', '/usr/share/koha/opac', 'ARRAY(0x56477b4391f0)') called at /usr/share/perl5/CGI/Compile.pm line 151 Code looks like: if ( !$borrower_number ) { $errLinkNotValid = 1; } my $borrower = Koha::Patrons->find($borrower_number); $template->param( new_password => 1, email => $email, uniqueKey => $uniqueKey, username => $username, errLinkNotValid => $errLinkNotValid, hasError => ( $errLinkNotValid ? 1 : 0 ), minPasswordLength => $borrower->category->effective_min_password_length, RequireStrongPassword => $borrower->category->effective_require_strong_password If the borrower_number is not found, the $borrower->category crashes. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 15

[Bug 11750] Overdue report does not limit patron attributes
by bugzilla-daemon＠bugs.koha-community.org 21 Feb '22

21 Feb '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11750 Victor Grousset/tuxayo <victor(a)tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Pushed to oldstable |RESOLVED CC| |victor(a)tuxayo.net --- Comment #10 from Victor Grousset/tuxayo <victor(a)tuxayo.net> --- Not backported to oldoldstable (20.11.x). Feel free to ask if it's needed. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 29764] New: EmbedItems RecordProcessor filter POD incorrect
by bugzilla-daemon＠bugs.koha-community.org 21 Feb '22

21 Feb '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29764 Bug ID: 29764 Summary: EmbedItems RecordProcessor filter POD incorrect Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: tomascohen(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 15

[Bug 29806] New: ->pickup_locations should always be called in scalar context
by bugzilla-daemon＠bugs.koha-community.org 21 Feb '22

21 Feb '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29806 Bug ID: 29806 Summary: ->pickup_locations should always be called in scalar context Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: tomascohen(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org The Koha::{Biblio|Item}->pickup_locations methods internally use Koha::Libraries->empty, which doesn't honour list context (bug 28871). When called in list context, if the Koha::Libraries resultset was built using ->empty, then things will explode, as exposed by bug 29804. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 29

[Bug 29807] New: Branches template doesn't handle empty lists correctly
by bugzilla-daemon＠bugs.koha-community.org 21 Feb '22

21 Feb '22

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29807 Bug ID: 29807 Summary: Branches template doesn't handle empty lists correctly Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Templates Assignee: oleonard(a)myacpl.org Reporter: tomascohen(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org The current code, given an 'item' or a 'biblio' param, makes 'pickup_locations' set @pickup_locations an empty list. After that, there's a check for emptiness, in which case it populates the @libraries variable with ALL PICKUP LOCATIONS, which is totally wrong! This is a bug introduced by bug 24350. -- You are receiving this mail because: You are watching all bug changes.

1 20