- Koha-bugs - lists.koha-community.org

[Bug 38969] Reflected XSS vulnerability in tags
by bugzilla-daemon＠bugs.koha-community.org 07 Apr '26

07 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38969 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=42254 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42274] New: opac-tags.pl should return JSON instead of JS script
by bugzilla-daemon＠bugs.koha-community.org 07 Apr '26

07 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42274 Bug ID: 42274 Summary: opac-tags.pl should return JSON instead of JS script Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: dcook(a)prosentient.com.au QA Contact: testopia(a)bugs.koha-community.org koha-tmpl/opac-tmpl/bootstrap/js/tags.js makes AJAX calls to ./opac/opac-tags.pl which returns Javascript scripts rather than JSON. The crazy part is that it's mostly just returning a JSON object anyway. There are some gotchas where it returns a JS object with embedded KOHA.Tags.tag_message() functions, but I'm sure we can fix that. -- You are receiving this mail because: You are watching all bug changes.

1 3

[Bug 38365] Add Content-Security-Policy HTTP header to HTML responses
by bugzilla-daemon＠bugs.koha-community.org 07 Apr '26

07 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=42274 -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 33254] New: 2FA - Trust Current Device
by bugzilla-daemon＠bugs.koha-community.org 07 Apr '26

07 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33254 Bug ID: 33254 Summary: 2FA - Trust Current Device Change sponsored?: --- Product: Koha Version: 22.05 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Staff interface Assignee: koha-bugs(a)lists.koha-community.org Reporter: tech.sam(a)salinapublic.org QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com Depends on: 20476 I've been testing the 2FA Koha module, I noticed there's currently no option to "trust current device" something that most MFA modules include, so a user can mark a local device to be excluded from the MFA check for an amount of time (typically a month or so). Not very essential, but would be a nice quality of life feature for users with dedicated machines. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20476 [Bug 20476] Two factor authentication for the staff client - omnibus -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 11

[Bug 42248] New: Confusing JS code when testing length
by bugzilla-daemon＠bugs.koha-community.org 07 Apr '26

07 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42248 Bug ID: 42248 Summary: Confusing JS code when testing length Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: jonathan.druart(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org if (!my_string.length > 0) is confusing and could be better written: if (my_string.length === 0) Found 4 occurrences: koha-tmpl/intranet-tmpl/prog/en/includes/html_helpers/tables/items/catalogue_detail.inc: if (!row.cover_image_ids.length > 0) { koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing.tt: if(!borrowernumbers.length > 0) { koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt: if ( ! $("#title_default").val().length > 0 ) { koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt: if ( ! content.length > 0 ) { ``` let content = "" undefined content.length 0 !content.length true !content.length>0 true 7m ago content = "foo" "foo" content.length 3 !content.length false !content.length>0 false ``` so... it works, but I am pretty sure it is not interpreted like how the author thought it would be (and I might be the author). -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 1

[Bug 28680] New: Staff without edit_borrower permission still see patron information
by bugzilla-daemon＠bugs.koha-community.org 07 Apr '26

07 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28680 Bug ID: 28680 Summary: Staff without edit_borrower permission still see patron information Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Patrons Assignee: koha-bugs(a)lists.koha-community.org Reporter: bwsdonna(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com The permission edit_borrowers specifies: Add, modify and view patron information. However, when that permission is not enabled, staff can view patron information in a number of places, including holds queue, circulation.pl, waitingreserves.pl, and pendingreserves.pl. In the Holds Queue staff can see patron name and other info for patrons at their library, but patrons from other libraries show "patron from central branch" etc. When looking at a bib record, if an item is checked out, only the borrower number is displayed. This should be consistent, where staff without that permission only see a borrower number and nothing else. To replicate, create a staff member with only permissions catalogue ( to log in) and circulate_remaining_permissions. Check out to a patron, see the holds queue, etc and see that the patron information is displayed. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 11

[Bug 37144] New: Add a subpermission for hiding patron contact information
by bugzilla-daemon＠bugs.koha-community.org 07 Apr '26

07 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37144 Bug ID: 37144 Summary: Add a subpermission for hiding patron contact information Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: ASSIGNED Severity: normal Priority: P5 - low Component: Patrons Assignee: Laura.escamilla(a)bywatersolutions.com Reporter: Laura.escamilla(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com Currently, Koha lacks a subpermission feature that allows libraries, especially those in correctional facilities utilizing inmate volunteers, to hide patron contact information (e.g., addresses) from certain users like volunteers. This privacy gap poses a significant risk, potentially exposing sensitive inmate data to unauthorized personnel. Implementing a subpermission feature would ensure that only authorized staff can access such sensitive information, addressing critical privacy concerns within these specialized library environments. -- You are receiving this mail because: You are watching all bug changes.

1 62

[Bug 39054] New: a need to distinguish between manual bibliographic record modifications and those being a consequence of authority modification
by bugzilla-daemon＠bugs.koha-community.org 06 Apr '26

06 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39054 Bug ID: 39054 Summary: a need to distinguish between manual bibliographic record modifications and those being a consequence of authority modification Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Transaction logs Assignee: koha-bugs(a)lists.koha-community.org Reporter: januszop(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org Now in action_logs, Koha does not distinguish between manual bibliographic record modifications and those being a consequence of authority modification. Both are logged in the same way: module: CATALOGUING ; operation: MODIFY ; interface: intranet. IMO it would be helpful to be able to distinguish this two cases. (For instance to be able to evaluate a librarian's 'koha' in the cataloguing process: a single action of modification of one authority record launching a modification of, say, 100 bibliographic records does not equal to manual modification of 100 bibliographic records. Also, if we trace issues in bibliographic records after modification being performed and want librarians to correct themselves, a biblio modification being a consequence of an authority modification should not be taken into account. Etc.) Comment are welcome. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 28

[Bug 42270] New: Log the date a framework changed
by bugzilla-daemon＠bugs.koha-community.org 06 Apr '26

06 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42270 Bug ID: 42270 Summary: Log the date a framework changed Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Cataloging Assignee: koha-bugs(a)lists.koha-community.org Reporter: mnero(a)oslri.net QA Contact: testopia(a)bugs.koha-community.org CC: m.de.rooy(a)rijksmuseum.nl We would like to be able to find out when a record was changed from FA to Default. In our workflow, we overlay brief records with full ones and change the framework during import. This overlay gets logged as action "Modify" but there's no indication of a framework change, so we can't differentiate an overlay modification from any other type of modification that might happen. Ideally, we would be able to find the timestamp of when the framework was changed and by which user, but having something in the Info that indicates what the frameworkcode is/was would be useful. A solution for bug 24843 might be related. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 35645] New: Modification Log only show changed values
by bugzilla-daemon＠bugs.koha-community.org 06 Apr '26

06 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35645 Bug ID: 35645 Summary: Modification Log only show changed values Change sponsored?: --- Product: Koha Version: 22.11 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Staff interface Assignee: koha-bugs(a)lists.koha-community.org Reporter: angela.berrett(a)familysearch.org QA Contact: testopia(a)bugs.koha-community.org CC: angela.berrett(a)familysearch.org, gmcharlt(a)gmail.com Created attachment 160266 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=160266&action=e… OLIB cataloging system item modification log The modification logs for a bib record puts all bibliographic and item information in a single text box when an edit occurs. For easier reading it would be nice to only show the fields/information that were modified. A previous catalog our library used would show a single line per change when an item was modified. It would show the date | person who made the change | old value | new value. This kept an accurate history and made reviewing the changes easy to read. As there is a single modification page for all items on a bib record the object column identifying which item was changed would need to be included. A similar table could be created for bib record modifications identifying the MARC field that was changed either in the Object column or in its own column, along with the old and new values. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 24